feat(api): add the Glue Data Catalog to the cloud explorer

Create and delete Glue databases, and describe a folder of CSV, JSON-lines or
Parquet files in S3 as a table: its columns, and for CSV the delimiter and
whether the first line is a header. Tables are written with the storage
settings Athena expects, so TheCloud's Athena can query one as soon as it
exists. Glue jobs and crawlers are not offered: the runtime stores them but
never runs them.

README.md

@@ -70,6 +70,7 @@ cd packages/api && bun run scripts/service-matrix.ts
 | Developer Tools | CodeDeploy | Yes (list, create, delete, inspect) | No | No |
 | Storage | Storage | Yes (list, create, delete, inspect) | Yes (list, create, delete, inspect) | Yes (list, create, delete, inspect) |
 | Storage | ECR / Elastic Container Registry | Yes (list, create, delete, inspect) | No | No |
+| Storage | EFS / File Systems | Yes (list, create, delete, inspect) | No | No |
 | Databases | Database | Yes (list, create, update, delete, inspect) | Yes (list, create, delete, inspect) | Yes (list, create, inspect, delete) |
 | Databases | DynamoDB / Cosmos DB NoSQL / NoSQL | Yes (list, create, delete, inspect) | Yes (list, create, delete, inspect) | No |
 | Databases | ElastiCache | Yes (list, create, delete, inspect) | No | No |
@@ -89,6 +90,7 @@ cd packages/api && bun run scripts/service-matrix.ts
 | Analytics | MSK / Managed Streaming for Kafka | Yes (legacy page) | No | No |
 | Analytics | MSK Connect / Managed Streaming for Kafka Connect | Yes (legacy page) | No | No |
 | Analytics | Kinesis / Kinesis Data Streams | Yes (list, create, inspect, delete) | No | No |
+| Analytics | Glue Data Catalog / Data Catalog | Yes (list, create, delete, inspect) | No | No |
 | Provisioning | CloudFormation / Infrastructure as Code | Yes (list, create, update, delete, inspect) | No | No |
 | Provisioning | AppConfig / Configuration | Yes (list, create, delete, inspect) | No | No |
 | Security | Identity | Yes (list, create, delete, inspect) | No | No |

packages/api/package.json

@@ -27,10 +27,12 @@
     "@aws-sdk/client-ec2": "^3.1076.0",
     "@aws-sdk/client-ecr": "^3.1076.0",
     "@aws-sdk/client-ecs": "^3.1076.0",
+    "@aws-sdk/client-efs": "^3.1146.0",
     "@aws-sdk/client-eks": "^3.1076.0",
     "@aws-sdk/client-elastic-load-balancing-v2": "^3.1096.0",
     "@aws-sdk/client-elasticache": "^3.1146.0",
     "@aws-sdk/client-eventbridge": "^3.1076.0",
+    "@aws-sdk/client-glue": "^3.1146.0",
     "@aws-sdk/client-iam": "^3.1076.0",
     "@aws-sdk/client-kafka": "^3.1146.0",
     "@aws-sdk/client-kafkaconnect": "^3.1146.0",

packages/api/src/adapter-aws/AwsDataCatalogAdapter.test.ts

@@ -0,0 +1,155 @@
+import {describe, expect, test} from 'bun:test'
+import {
+    CreateDatabaseCommand,
+    CreateTableCommand,
+    DeleteDatabaseCommand,
+    DeleteTableCommand,
+    GetDatabaseCommand,
+    GetDatabasesCommand,
+    GetTablesCommand,
+    type GlueClient,
+} from '@aws-sdk/client-glue'
+import {AwsDataCatalogAdapter, describeTable} from './AwsDataCatalogAdapter'
+import {NotFoundError, ValidationError} from '../cloud-spi/errors'
+
+type SendResult = Record<string, unknown>
+
+const database = {Name: 'shop', Description: 'Orders and customers', LocationUri: 's3://data/shop/', CatalogId: '000000000000', CreateTime: new Date('2026-10-25T18:00:00Z')}
+const ordersTable = {
+    Name: 'orders',
+    TableType: 'EXTERNAL_TABLE',
+    Parameters: {classification: 'csv', 'skip.header.line.count': '1'},
+    StorageDescriptor: {
+        Columns: [{Name: 'id', Type: 'int'}, {Name: 'amount', Type: 'double'}],
+        Location: 's3://data/orders/',
+        InputFormat: 'org.apache.hadoop.mapred.TextInputFormat',
+        SerdeInfo: {SerializationLibrary: 'org.apache.hadoop.hive.serde2.lazy.LazySimpleSerDe', Parameters: {'field.delim': ';'}},
+    },
+    PartitionKeys: [{Name: 'day', Type: 'string'}],
+}
+const eventsTable = {
+    Name: 'events',
+    StorageDescriptor: {Columns: [{Name: 'kind', Type: 'string'}], Location: 's3://data/events/', SerdeInfo: {SerializationLibrary: 'org.openx.data.jsonserde.JsonSerDe'}},
+}
+
+function adapterWith(handler: (command: object) => SendResult | undefined = () => undefined) {
+    const sent: object[] = []
+    const client = {
+        async send(command: object) {
+            sent.push(command)
+            const result = handler(command)
+            if (result) return result
+            if (command instanceof GetDatabasesCommand) return {DatabaseList: [database]}
+            if (command instanceof GetDatabaseCommand) return {Database: database}
+            if (command instanceof GetTablesCommand) return {TableList: [ordersTable, eventsTable]}
+            return {}
+        },
+    }
+    return {sent, adapter: new AwsDataCatalogAdapter(client as unknown as GlueClient)}
+}
+
+describe('AwsDataCatalogAdapter', () => {
+    test('lists databases across pages with their table counts', async () => {
+        const {adapter} = adapterWith((command) => {
+            if (command instanceof GetDatabasesCommand) {
+                return command.input.NextToken ? {DatabaseList: [{Name: 'logs'}]} : {DatabaseList: [database], NextToken: 'n'}
+            }
+            if (command instanceof GetTablesCommand && command.input.DatabaseName === 'logs') return {TableList: []}
+            return undefined
+        })
+
+        const listed = await adapter.list()
+        expect(listed.map((db) => [db.name, db.metadata.tableCount, db.metadata.description])).toEqual([['shop', 2, 'Orders and customers'], ['logs', 0, null]])
+        expect((await adapter.list({search: 'customers'})).map((db) => db.name)).toEqual(['shop'])
+    })
+
+    test('describes each table with its format, location and columns, sorted by name', async () => {
+        const {adapter} = adapterWith()
+        const detail = await adapter.get('shop')
+        const tables = detail?.metadata.tables as Array<Record<string, unknown>>
+
+        expect(tables.map((table) => table.name)).toEqual(['events', 'orders'])
+        expect(tables[1]).toMatchObject({format: 'csv', delimiter: ';', headerRow: true, location: 's3://data/orders/', columns: [{name: 'id', type: 'int'}, {name: 'amount', type: 'double'}], partitionKeys: [{name: 'day', type: 'string'}]})
+        expect(tables[0]).toMatchObject({format: 'json', delimiter: null, headerRow: false})
+    })
+
+    test('reads the format the way the query engine does', () => {
+        expect(describeTable({Name: 'p', StorageDescriptor: {InputFormat: 'org.apache.hadoop.hive.ql.io.parquet.MapredParquetInputFormat'}}).format).toBe('parquet')
+        expect(describeTable({Name: 'i', Parameters: {table_type: 'ICEBERG'}}).format).toBe('iceberg')
+        expect(describeTable({Name: 'c'}).format).toBe('csv')
+    })
+
+    test('returns null for a database that does not exist', async () => {
+        const missing = Object.assign(new Error('missing'), {name: 'EntityNotFoundException'})
+        const {adapter} = adapterWith((command) => { if (command instanceof GetDatabaseCommand) throw missing; return undefined })
+        expect(await adapter.get('nope')).toBeNull()
+    })
+
+    test('creates a database with an optional description and location', async () => {
+        const {adapter, sent} = adapterWith()
+        await adapter.create({values: {name: 'shop', description: 'Orders', locationUri: 's3://data/shop/'}})
+        expect((sent.find((command) => command instanceof CreateDatabaseCommand) as CreateDatabaseCommand).input).toEqual({DatabaseInput: {Name: 'shop', Description: 'Orders', LocationUri: 's3://data/shop/'}})
+
+        await expect(adapter.create({values: {name: 'Shop'}})).rejects.toBeInstanceOf(ValidationError)
+        await expect(adapter.create({values: {name: 'shop', locationUri: 'https://example.com'}})).rejects.toBeInstanceOf(ValidationError)
+    })
+
+    test('creates a CSV table Athena can read, with its delimiter and header row', async () => {
+        const {adapter, sent} = adapterWith()
+        await adapter.createCatalogTable('shop', {name: 'orders', location: 's3://data/orders', format: 'csv', delimiter: ';', headerRow: true, columns: [{name: 'id', type: 'int'}, {name: 'amount', type: 'DOUBLE'}]})
+
+        const create = sent.find((command) => command instanceof CreateTableCommand) as CreateTableCommand
+        expect(create.input).toEqual({
+            DatabaseName: 'shop',
+            TableInput: {
+                Name: 'orders',
+                TableType: 'EXTERNAL_TABLE',
+                Parameters: {classification: 'csv', EXTERNAL: 'TRUE', 'skip.header.line.count': '1'},
+                StorageDescriptor: {
+                    Columns: [{Name: 'id', Type: 'int'}, {Name: 'amount', Type: 'double'}],
+                    Location: 's3://data/orders/',
+                    InputFormat: 'org.apache.hadoop.mapred.TextInputFormat',
+                    OutputFormat: 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat',
+                    SerdeInfo: {SerializationLibrary: 'org.apache.hadoop.hive.serde2.lazy.LazySimpleSerDe', Parameters: {'field.delim': ';'}},
+                },
+            },
+        })
+    })
+
+    test('creates JSON and Parquet tables with their own SerDe', async () => {
+        const {adapter, sent} = adapterWith()
+        await adapter.createCatalogTable('shop', {name: 'events', location: 's3://data/events/', format: 'json', columns: [{name: 'kind', type: 'string'}]})
+        await adapter.createCatalogTable('shop', {name: 'facts', location: 's3://data/facts/', format: 'parquet', columns: [{name: 'total', type: 'decimal(12,2)'}]})
+
+        const [json, parquet] = sent.filter((command) => command instanceof CreateTableCommand) as CreateTableCommand[]
+        expect(json.input.TableInput?.StorageDescriptor?.SerdeInfo).toEqual({SerializationLibrary: 'org.openx.data.jsonserde.JsonSerDe'})
+        expect(parquet.input.TableInput?.StorageDescriptor?.InputFormat).toBe('org.apache.hadoop.hive.ql.io.parquet.MapredParquetInputFormat')
+        expect(parquet.input.TableInput?.StorageDescriptor?.Columns).toEqual([{Name: 'total', Type: 'decimal(12,2)'}])
+    })
+
+    test('refuses tables Athena could not query', async () => {
+        const {adapter} = adapterWith()
+        const table = {name: 'orders', location: 's3://data/orders/', format: 'csv' as const, columns: [{name: 'id', type: 'int'}]}
+
+        await expect(adapter.createCatalogTable('shop', {...table, columns: []})).rejects.toBeInstanceOf(ValidationError)
+        await expect(adapter.createCatalogTable('shop', {...table, columns: [{name: 'id', type: 'int'}, {name: 'id', type: 'string'}]})).rejects.toThrow(/listed twice/)
+        await expect(adapter.createCatalogTable('shop', {...table, columns: [{name: 'id', type: 'uuid'}]})).rejects.toBeInstanceOf(ValidationError)
+        await expect(adapter.createCatalogTable('shop', {...table, location: '/tmp/orders'})).rejects.toBeInstanceOf(ValidationError)
+        await expect(adapter.createCatalogTable('shop', {...table, delimiter: '||'})).rejects.toBeInstanceOf(ValidationError)
+        await expect(adapter.createCatalogTable('shop', {...table, format: 'avro' as never})).rejects.toBeInstanceOf(ValidationError)
+    })
+
+    test('creating a table in a missing database is a not-found', async () => {
+        const missing = Object.assign(new Error('missing'), {name: 'EntityNotFoundException'})
+        const {adapter} = adapterWith((command) => { if (command instanceof GetDatabaseCommand) throw missing; return undefined })
+        await expect(adapter.createCatalogTable('nope', {name: 'orders', location: 's3://data/orders/', format: 'json', columns: [{name: 'id', type: 'int'}]})).rejects.toBeInstanceOf(NotFoundError)
+    })
+
+    test('deletes tables and databases', async () => {
+        const {adapter, sent} = adapterWith()
+        await adapter.deleteCatalogTable('shop', 'orders')
+        await adapter.delete('shop')
+        expect((sent.find((command) => command instanceof DeleteTableCommand) as DeleteTableCommand).input).toEqual({DatabaseName: 'shop', Name: 'orders'})
+        expect((sent.find((command) => command instanceof DeleteDatabaseCommand) as DeleteDatabaseCommand).input).toEqual({Name: 'shop'})
+    })
+})

packages/api/src/adapter-aws/AwsDataCatalogAdapter.ts

@@ -0,0 +1,257 @@
+import {
+    CreateDatabaseCommand,
+    CreateTableCommand,
+    type Database,
+    DeleteDatabaseCommand,
+    DeleteTableCommand,
+    GetDatabaseCommand,
+    GetDatabasesCommand,
+    GetTablesCommand,
+    type GlueClient,
+    type StorageDescriptor,
+    type Table,
+} from '@aws-sdk/client-glue'
+import {NotFoundError, RuntimeError, ValidationError} from '../cloud-spi/errors'
+import {awsDataCatalogSchema, CATALOG_COLUMN_TYPES, CATALOG_NAME_PATTERN, CATALOG_TABLE_FORMATS} from '../cloud-spi/dataCatalogSchema'
+import type {CatalogTableInput, CloudResource, CloudServiceAdapter, CreateResourceInput, ResourceQuery, ServiceSchema} from '../cloud-spi/types'
+
+const S3_URI = /^s3:\/\/[a-z0-9.-]{3,63}(\/.*)?$/
+const DECIMAL_TYPE = /^decimal\(\d{1,2},\d{1,2}\)$/
+
+/** The Hive storage settings Athena expects for each format, as the Glue console writes them. */
+const STORAGE_FOR_FORMAT = {
+    csv: {
+        InputFormat: 'org.apache.hadoop.mapred.TextInputFormat',
+        OutputFormat: 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat',
+        SerializationLibrary: 'org.apache.hadoop.hive.serde2.lazy.LazySimpleSerDe',
+    },
+    json: {
+        InputFormat: 'org.apache.hadoop.mapred.TextInputFormat',
+        OutputFormat: 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat',
+        SerializationLibrary: 'org.openx.data.jsonserde.JsonSerDe',
+    },
+    parquet: {
+        InputFormat: 'org.apache.hadoop.hive.ql.io.parquet.MapredParquetInputFormat',
+        OutputFormat: 'org.apache.hadoop.hive.ql.io.parquet.MapredParquetOutputFormat',
+        SerializationLibrary: 'org.apache.hadoop.hive.ql.io.parquet.serde.ParquetHiveSerDe',
+    },
+} as const
+
+/**
+ * Talks to the AWS Glue Data Catalog, verified against Floci core (community, `latest`).
+ *
+ * Notes from probing the runtime:
+ *  - The catalog is what TheCloud's Athena reads: a table over CSV, JSON lines
+ *    or Parquet files in S3 can be queried as soon as it exists.
+ *  - Glue jobs and crawlers are stored but never run, so the console offers
+ *    only the catalog: databases and the tables in them.
+ *  - DeleteDatabase removes the database's tables too, as it does in AWS.
+ */
+export class AwsDataCatalogAdapter implements CloudServiceAdapter {
+    readonly cloud = 'aws' as const
+    readonly service = 'datacatalog' as const
+
+    constructor(private readonly glue: GlueClient) {}
+
+    schema(): ServiceSchema {
+        return awsDataCatalogSchema()
+    }
+
+    async list(query: ResourceQuery = {}): Promise<CloudResource[]> {
+        const found: Database[] = []
+        let next: string | undefined
+        do {
+            const res = await this.glue.send(new GetDatabasesCommand({MaxResults: 100, ...(next ? {NextToken: next} : {})}))
+            found.push(...(res.DatabaseList ?? []))
+            next = res.NextToken
+        } while (next)
+
+        const search = query.search?.trim().toLowerCase()
+        const matching = found.filter((database) => !search
+            || (database.Name ?? '').toLowerCase().includes(search)
+            || (database.Description ?? '').toLowerCase().includes(search))
+        return Promise.all(matching.map(async (database) => toResource(database, {tableCount: (await this.tables(database.Name ?? '')).length})))
+    }
+
+    async get(id: string): Promise<CloudResource | null> {
+        const database = await this.database(id)
+        if (!database) return null
+        const tables = await this.tables(id)
+        return toResource(database, {tableCount: tables.length, tables})
+    }
+
+    async create(input: CreateResourceInput): Promise<CloudResource> {
+        const values = input.values
+        const name = catalogName(values.name, 'name')
+        const description = text(values.description)
+        const locationUri = text(values.locationUri)
+        if (locationUri && !S3_URI.test(locationUri)) throw new ValidationError('locationUri must be an S3 URI such as s3://my-bucket/warehouse/')
+
+        await this.glue.send(new CreateDatabaseCommand({
+            DatabaseInput: {
+                Name: name,
+                ...(description ? {Description: description} : {}),
+                ...(locationUri ? {LocationUri: locationUri} : {}),
+            },
+        }))
+        const created = await this.get(name)
+        if (!created) throw new RuntimeError(`Glue did not return the new database ${name}`)
+        return created
+    }
+
+    async delete(id: string): Promise<void> {
+        await this.glue.send(new DeleteDatabaseCommand({Name: id}))
+    }
+
+    async createCatalogTable(databaseName: string, input: CatalogTableInput): Promise<CloudResource> {
+        const name = catalogName(input.name, 'name')
+        const location = text(input.location)
+        if (!S3_URI.test(location)) throw new ValidationError('location must be an S3 URI such as s3://my-bucket/orders/')
+        const format = text(input.format) as CatalogTableInput['format']
+        if (!(CATALOG_TABLE_FORMATS as readonly string[]).includes(format)) throw new ValidationError(`format must be one of ${CATALOG_TABLE_FORMATS.join(', ')}`)
+        const columns = tableColumns(input.columns)
+        const delimiter = typeof input.delimiter === 'string' && input.delimiter !== '' ? input.delimiter : ','
+        if (format === 'csv' && [...delimiter].length !== 1) throw new ValidationError('delimiter must be a single character')
+        const description = text(input.description)
+        if (!await this.database(databaseName)) throw new NotFoundError(`Database ${databaseName} not found`)
+
+        const storage = STORAGE_FOR_FORMAT[format]
+        const csv = format === 'csv'
+        await this.glue.send(new CreateTableCommand({
+            DatabaseName: databaseName,
+            TableInput: {
+                Name: name,
+                TableType: 'EXTERNAL_TABLE',
+                ...(description ? {Description: description} : {}),
+                Parameters: {
+                    classification: format,
+                    EXTERNAL: 'TRUE',
+                    ...(csv && input.headerRow ? {'skip.header.line.count': '1'} : {}),
+                },
+                StorageDescriptor: {
+                    Columns: columns.map((column) => ({Name: column.name, Type: column.type})),
+                    // Athena reads every file under the prefix, so the location is a directory.
+                    Location: location.endsWith('/') ? location : `${location}/`,
+                    InputFormat: storage.InputFormat,
+                    OutputFormat: storage.OutputFormat,
+                    SerdeInfo: {
+                        SerializationLibrary: storage.SerializationLibrary,
+                        ...(csv ? {Parameters: {'field.delim': delimiter}} : {}),
+                    },
+                },
+            },
+        }))
+        return this.detail(databaseName)
+    }
+
+    async deleteCatalogTable(databaseName: string, tableName: string): Promise<CloudResource> {
+        await this.glue.send(new DeleteTableCommand({DatabaseName: databaseName, Name: tableName}))
+        return this.detail(databaseName)
+    }
+
+    private async database(name: string): Promise<Database | null> {
+        try {
+            return (await this.glue.send(new GetDatabaseCommand({Name: name}))).Database ?? null
+        } catch (error) {
+            if (errorName(error) === 'EntityNotFoundException') return null
+            throw error
+        }
+    }
+
+    private async detail(name: string): Promise<CloudResource> {
+        const detail = await this.get(name)
+        if (!detail) throw new NotFoundError(`Database ${name} not found`)
+        return detail
+    }
+
+    private async tables(databaseName: string): Promise<Table[]> {
+        const found: Table[] = []
+        let next: string | undefined
+        do {
+            const res = await this.glue.send(new GetTablesCommand({DatabaseName: databaseName, MaxResults: 100, ...(next ? {NextToken: next} : {})}))
+            found.push(...(res.TableList ?? []))
+            next = res.NextToken
+        } while (next)
+        return found.sort((a, b) => (a.Name ?? '').localeCompare(b.Name ?? ''))
+    }
+}
+
+function toResource(database: Database, detail: {tableCount: number; tables?: Table[]}): CloudResource {
+    const name = database.Name ?? ''
+    return {
+        id: name,
+        name,
+        cloud: 'aws',
+        service: 'datacatalog',
+        type: 'glueDatabase',
+        region: null,
+        createdAt: database.CreateTime ? database.CreateTime.toISOString() : null,
+        metadata: {
+            description: database.Description || null,
+            locationUri: database.LocationUri || null,
+            catalogId: database.CatalogId ?? null,
+            tableCount: detail.tableCount,
+            ...(detail.tables ? {tables: detail.tables.map(describeTable)} : {}),
+        },
+    }
+}
+
+/** What the panel shows for a table: its files, how they are read, and its columns. */
+export function describeTable(table: Table) {
+    const storage: StorageDescriptor = table.StorageDescriptor ?? {}
+    const format = tableFormat(table)
+    return {
+        name: table.Name ?? '',
+        description: table.Description || null,
+        format,
+        location: storage.Location ?? null,
+        delimiter: format === 'csv' ? storage.SerdeInfo?.Parameters?.['field.delim'] ?? ',' : null,
+        headerRow: table.Parameters?.['skip.header.line.count'] === '1',
+        columns: (storage.Columns ?? []).map((column) => ({name: column.Name ?? '', type: column.Type ?? ''})),
+        partitionKeys: (table.PartitionKeys ?? []).map((column) => ({name: column.Name ?? '', type: column.Type ?? ''})),
+        tableType: table.TableType ?? null,
+        createdAt: table.CreateTime ? table.CreateTime.toISOString() : null,
+        updatedAt: table.UpdateTime ? table.UpdateTime.toISOString() : null,
+    }
+}
+
+/** The same order the runtime's Athena engine checks a table's storage in. */
+function tableFormat(table: Table): string {
+    const classification = table.Parameters?.classification?.toLowerCase()
+    if (classification === 'iceberg' || table.Parameters?.table_type?.toLowerCase() === 'iceberg') return 'iceberg'
+    const storage = table.StorageDescriptor
+    const hints = `${storage?.InputFormat ?? ''} ${storage?.SerdeInfo?.SerializationLibrary ?? ''}`.toLowerCase()
+    if (hints.includes('parquet')) return 'parquet'
+    if (hints.includes('json')) return 'json'
+    return classification || 'csv'
+}
+
+function tableColumns(value: unknown): Array<{name: string; type: string}> {
+    if (!Array.isArray(value) || value.length === 0) throw new ValidationError('columns must list at least one column')
+    const seen = new Set<string>()
+    return value.map((column, index) => {
+        const entry = typeof column === 'object' && column !== null ? column as Record<string, unknown> : {}
+        const name = catalogName(entry.name, `columns[${index}].name`)
+        if (seen.has(name)) throw new ValidationError(`column ${name} is listed twice`)
+        seen.add(name)
+        const type = text(entry.type).toLowerCase()
+        if (!(CATALOG_COLUMN_TYPES as readonly string[]).includes(type) && !DECIMAL_TYPE.test(type)) {
+            throw new ValidationError(`columns[${index}].type must be one of ${CATALOG_COLUMN_TYPES.join(', ')}`)
+        }
+        return {name, type}
+    })
+}
+
+function catalogName(value: unknown, field: string): string {
+    const name = text(value)
+    if (!new RegExp(CATALOG_NAME_PATTERN).test(name)) throw new ValidationError(`${field} must be lowercase letters, numbers and underscores, starting with a letter or underscore`)
+    return name
+}
+
+function text(value: unknown): string {
+    return typeof value === 'string' ? value.trim() : ''
+}
+
+function errorName(error: unknown): string | undefined {
+    return typeof error === 'object' && error !== null ? (error as {name?: string}).name : undefined
+}

packages/api/src/adapter-aws/AwsFileSystemsAdapter.test.ts

@@ -0,0 +1,199 @@
+import {describe, expect, test} from 'bun:test'
+import {
+    CreateAccessPointCommand,
+    CreateFileSystemCommand,
+    CreateMountTargetCommand,
+    DeleteAccessPointCommand,
+    DeleteFileSystemCommand,
+    DeleteMountTargetCommand,
+    DescribeAccessPointsCommand,
+    DescribeFileSystemsCommand,
+    DescribeMountTargetsCommand,
+    type EFSClient,
+} from '@aws-sdk/client-efs'
+import {DescribeSecurityGroupsCommand, DescribeSubnetsCommand, type EC2Client} from '@aws-sdk/client-ec2'
+import {GetFunctionConfigurationCommand, type LambdaClient, ListFunctionsCommand, UpdateFunctionConfigurationCommand} from '@aws-sdk/client-lambda'
+import {AwsFileSystemsAdapter} from './AwsFileSystemsAdapter'
+import {ConflictError, NotFoundError, ValidationError} from '../cloud-spi/errors'
+
+type SendResult = Record<string, unknown>
+
+function stub(handler: (command: object) => SendResult | undefined) {
+    const sent: object[] = []
+    const client = {
+        async send(command: object) {
+            sent.push(command)
+            return handler(command) ?? {}
+        },
+    }
+    return {client, sent}
+}
+
+const accessPointArn = 'arn:aws:elasticfilesystem:us-east-1:000000000000:access-point/fsap-1'
+const fileSystem = {
+    FileSystemId: 'fs-1',
+    FileSystemArn: 'arn:aws:elasticfilesystem:us-east-1:000000000000:file-system/fs-1',
+    Name: 'shared',
+    LifeCycleState: 'available',
+    NumberOfMountTargets: 1,
+    PerformanceMode: 'generalPurpose',
+    ThroughputMode: 'bursting',
+    Encrypted: true,
+    CreationTime: new Date('2026-10-25T17:09:01Z'),
+}
+const mountTarget = {MountTargetId: 'fsmt-1', FileSystemId: 'fs-1', SubnetId: 'subnet-a', AvailabilityZoneName: 'us-east-1a', IpAddress: '10.0.0.10', VpcId: 'vpc-1', LifeCycleState: 'available'}
+const accessPoint = {
+    AccessPointId: 'fsap-1', AccessPointArn: accessPointArn, FileSystemId: 'fs-1', Name: 'app',
+    PosixUser: {Uid: 1000, Gid: 1000}, RootDirectory: {Path: '/app', CreationInfo: {OwnerUid: 1000, OwnerGid: 1000, Permissions: '755'}}, LifeCycleState: 'available',
+}
+const writer = {FunctionName: 'writer', FileSystemConfigs: [{Arn: accessPointArn, LocalMountPath: '/mnt/share'}]}
+
+function adapterWith({efs = () => undefined, lambda = () => undefined, functions = [writer]}: {
+    efs?: (command: object) => SendResult | undefined
+    lambda?: (command: object) => SendResult | undefined
+    functions?: object[]
+} = {}) {
+    const efsStub = stub((command) => efs(command) ?? (
+        command instanceof DescribeFileSystemsCommand ? {FileSystems: [fileSystem]}
+            : command instanceof DescribeMountTargetsCommand ? {MountTargets: [mountTarget]}
+            : command instanceof DescribeAccessPointsCommand ? {AccessPoints: [accessPoint]}
+            : command instanceof CreateFileSystemCommand ? {FileSystemId: 'fs-1'}
+            : undefined))
+    const lambdaStub = stub((command) => lambda(command) ?? (command instanceof ListFunctionsCommand ? {Functions: functions} : undefined))
+    const ec2Stub = stub((command) => command instanceof DescribeSubnetsCommand
+        ? {Subnets: [{SubnetId: 'subnet-b', AvailabilityZone: 'us-east-1b'}, {SubnetId: 'subnet-a', AvailabilityZone: 'us-east-1a'}, {SubnetId: 'subnet-a2', AvailabilityZone: 'us-east-1a'}]}
+        : command instanceof DescribeSecurityGroupsCommand ? {SecurityGroups: [{GroupId: 'sg-default'}]}
+        : undefined)
+    return {
+        efsSent: efsStub.sent,
+        lambdaSent: lambdaStub.sent,
+        adapter: new AwsFileSystemsAdapter(efsStub.client as unknown as EFSClient, lambdaStub.client as unknown as LambdaClient, ec2Stub.client as unknown as EC2Client),
+    }
+}
+
+describe('AwsFileSystemsAdapter', () => {
+    test('lists file systems across pages and searches by name or id', async () => {
+        const {adapter} = adapterWith({
+            efs: (command) => command instanceof DescribeFileSystemsCommand
+                ? command.input.Marker ? {FileSystems: [{...fileSystem, FileSystemId: 'fs-2', Name: undefined, Tags: [{Key: 'Name', Value: 'logs'}]}]} : {FileSystems: [fileSystem], NextMarker: 'm'}
+                : undefined,
+        })
+
+        const listed = await adapter.list()
+        expect(listed.map((fs) => [fs.id, fs.name, fs.status, fs.metadata.encrypted])).toEqual([['fs-1', 'shared', 'available', true], ['fs-2', 'logs', 'available', true]])
+        expect((await adapter.list({search: 'fs-2'})).map((fs) => fs.name)).toEqual(['logs'])
+    })
+
+    test('describes mount targets, access points and the functions that mount it', async () => {
+        const {adapter} = adapterWith({functions: [writer, {FunctionName: 'other'}]})
+        const detail = await adapter.get('fs-1')
+
+        expect(detail?.metadata.mountTargets).toEqual([{id: 'fsmt-1', subnetId: 'subnet-a', availabilityZone: 'us-east-1a', ipAddress: '10.0.0.10', vpcId: 'vpc-1', state: 'available'}])
+        expect(detail?.metadata.accessPoints).toEqual([{id: 'fsap-1', arn: accessPointArn, name: 'app', path: '/app', uid: 1000, gid: 1000, permissions: '755', state: 'available'}])
+        expect(detail?.metadata.functions).toEqual([{name: 'writer', accessPointId: 'fsap-1', mountPath: '/mnt/share'}])
+    })
+
+    test('returns null for a file system that does not exist', async () => {
+        const missing = Object.assign(new Error('not found'), {name: 'FileSystemNotFound'})
+        const {adapter} = adapterWith({efs: (command) => { if (command instanceof DescribeFileSystemsCommand) throw missing; return undefined }})
+        expect(await adapter.get('fs-nope')).toBeNull()
+    })
+
+    test('creates an encrypted file system with one mount target per default zone', async () => {
+        const {adapter, efsSent} = adapterWith()
+        await adapter.create({values: {name: 'shared', performanceMode: 'generalPurpose', throughputMode: 'elastic', encrypted: 'true', mountTargets: 'default'}})
+
+        const create = efsSent.find((command) => command instanceof CreateFileSystemCommand) as CreateFileSystemCommand
+        expect(create.input).toMatchObject({PerformanceMode: 'generalPurpose', ThroughputMode: 'elastic', Encrypted: true, Tags: [{Key: 'Name', Value: 'shared'}]})
+        const mounts = efsSent.filter((command) => command instanceof CreateMountTargetCommand) as CreateMountTargetCommand[]
+        expect(mounts.map((command) => command.input.SubnetId)).toEqual(['subnet-a', 'subnet-b'])
+    })
+
+    test('can create a file system without mount targets, and refuses unknown modes', async () => {
+        const {adapter, efsSent} = adapterWith()
+        await adapter.create({values: {mountTargets: 'none', encrypted: 'false'}})
+        expect(efsSent.some((command) => command instanceof CreateMountTargetCommand)).toBe(false)
+        expect((efsSent.find((command) => command instanceof CreateFileSystemCommand) as CreateFileSystemCommand).input.Encrypted).toBe(false)
+
+        await expect(adapter.create({values: {throughputMode: 'provisioned'}})).rejects.toBeInstanceOf(ValidationError)
+    })
+
+    test('deletes access points and mount targets before the file system', async () => {
+        const {adapter, efsSent} = adapterWith({functions: []})
+        await adapter.delete('fs-1')
+
+        const order = efsSent.filter((command) => command instanceof DeleteAccessPointCommand || command instanceof DeleteMountTargetCommand || command instanceof DeleteFileSystemCommand)
+            .map((command) => command.constructor.name)
+        expect(order).toEqual(['DeleteAccessPointCommand', 'DeleteMountTargetCommand', 'DeleteFileSystemCommand'])
+    })
+
+    test('refuses to delete a file system or access point a function still mounts', async () => {
+        const {adapter, efsSent} = adapterWith()
+        await expect(adapter.delete('fs-1')).rejects.toBeInstanceOf(ConflictError)
+        await expect(adapter.deleteAccessPoint('fs-1', 'fsap-1')).rejects.toBeInstanceOf(ConflictError)
+        expect(efsSent.some((command) => command instanceof DeleteFileSystemCommand || command instanceof DeleteAccessPointCommand)).toBe(false)
+    })
+
+    test('creates an access point whose root EFS makes for its POSIX user', async () => {
+        const {adapter, efsSent} = adapterWith()
+        await adapter.createAccessPoint('fs-1', {name: 'app', path: '/app', uid: 1000, gid: 1000, permissions: '750'})
+
+        const create = efsSent.find((command) => command instanceof CreateAccessPointCommand) as CreateAccessPointCommand
+        expect(create.input).toMatchObject({
+            FileSystemId: 'fs-1',
+            PosixUser: {Uid: 1000, Gid: 1000},
+            RootDirectory: {Path: '/app', CreationInfo: {OwnerUid: 1000, OwnerGid: 1000, Permissions: '750'}},
+            Tags: [{Key: 'Name', Value: 'app'}],
+        })
+        await expect(adapter.createAccessPoint('fs-1', {path: 'app', uid: 1000, gid: 1000, permissions: '755'})).rejects.toBeInstanceOf(ValidationError)
+        await expect(adapter.createAccessPoint('fs-1', {path: '/app', uid: -1, gid: 1000, permissions: '755'})).rejects.toBeInstanceOf(ValidationError)
+        await expect(adapter.createAccessPoint('fs-1', {path: '/app', uid: 1000, gid: 1000, permissions: '999'})).rejects.toBeInstanceOf(ValidationError)
+    })
+
+    test('adds and removes mount targets that belong to the file system', async () => {
+        const {adapter, efsSent} = adapterWith()
+        await adapter.createMountTarget('fs-1', 'subnet-c')
+        expect((efsSent.find((command) => command instanceof CreateMountTargetCommand) as CreateMountTargetCommand).input).toEqual({FileSystemId: 'fs-1', SubnetId: 'subnet-c'})
+
+        await adapter.deleteMountTarget('fs-1', 'fsmt-1')
+        expect(efsSent.some((command) => command instanceof DeleteMountTargetCommand)).toBe(true)
+        await expect(adapter.deleteMountTarget('fs-1', 'fsmt-other')).rejects.toBeInstanceOf(NotFoundError)
+        await expect(adapter.createMountTarget('fs-1', 'not-a-subnet')).rejects.toBeInstanceOf(ValidationError)
+    })
+
+    test('attaching puts a function without a VPC in the mount target subnets', async () => {
+        const {adapter, lambdaSent} = adapterWith({lambda: (command) => command instanceof GetFunctionConfigurationCommand ? {FunctionName: 'reader'} : undefined})
+        await adapter.attachFileSystemToFunction('fs-1', {accessPointId: 'fsap-1', functionName: 'reader', mountPath: '/mnt/share'})
+
+        const update = lambdaSent.find((command) => command instanceof UpdateFunctionConfigurationCommand) as UpdateFunctionConfigurationCommand
+        expect(update.input).toEqual({
+            FunctionName: 'reader',
+            FileSystemConfigs: [{Arn: accessPointArn, LocalMountPath: '/mnt/share'}],
+            VpcConfig: {SubnetIds: ['subnet-a'], SecurityGroupIds: ['sg-default']},
+        })
+    })
+
+    test('attaching keeps a function that is already in a VPC where it is', async () => {
+        const {adapter, lambdaSent} = adapterWith({lambda: (command) => command instanceof GetFunctionConfigurationCommand ? {FunctionName: 'reader', VpcConfig: {SubnetIds: ['subnet-z']}} : undefined})
+        await adapter.attachFileSystemToFunction('fs-1', {accessPointId: 'fsap-1', functionName: 'reader', mountPath: '/mnt/share'})
+
+        const update = lambdaSent.find((command) => command instanceof UpdateFunctionConfigurationCommand) as UpdateFunctionConfigurationCommand
+        expect(update.input.VpcConfig).toBeUndefined()
+        await expect(adapter.attachFileSystemToFunction('fs-1', {accessPointId: 'fsap-1', functionName: 'reader', mountPath: '/data'})).rejects.toBeInstanceOf(ValidationError)
+        await expect(adapter.attachFileSystemToFunction('fs-1', {accessPointId: 'fsap-x', functionName: 'reader', mountPath: '/mnt/share'})).rejects.toBeInstanceOf(NotFoundError)
+    })
+
+    test('cannot attach before the file system has a mount target', async () => {
+        const {adapter} = adapterWith({
+            efs: (command) => command instanceof DescribeMountTargetsCommand ? {MountTargets: []} : undefined,
+            lambda: (command) => command instanceof GetFunctionConfigurationCommand ? {FunctionName: 'reader'} : undefined,
+        })
+        await expect(adapter.attachFileSystemToFunction('fs-1', {accessPointId: 'fsap-1', functionName: 'reader', mountPath: '/mnt/share'})).rejects.toThrow(/Add a mount target first/)
+    })
+
+    test('detaching clears the function file systems', async () => {
+        const {adapter, lambdaSent} = adapterWith()
+        await adapter.detachFileSystemFromFunction('fs-1', 'writer')
+        expect((lambdaSent.find((command) => command instanceof UpdateFunctionConfigurationCommand) as UpdateFunctionConfigurationCommand).input).toEqual({FunctionName: 'writer', FileSystemConfigs: []})
+    })
+})

packages/api/src/adapter-aws/AwsFileSystemsAdapter.ts

@@ -0,0 +1,351 @@
+import {
+    type AccessPointDescription,
+    CreateAccessPointCommand,
+    CreateFileSystemCommand,
+    CreateMountTargetCommand,
+    DeleteAccessPointCommand,
+    DeleteFileSystemCommand,
+    DeleteMountTargetCommand,
+    DescribeAccessPointsCommand,
+    DescribeFileSystemsCommand,
+    DescribeMountTargetsCommand,
+    type EFSClient,
+    type FileSystemDescription,
+    type MountTargetDescription,
+} from '@aws-sdk/client-efs'
+import {DescribeSecurityGroupsCommand, DescribeSubnetsCommand, type EC2Client} from '@aws-sdk/client-ec2'
+import {type FunctionConfiguration, GetFunctionConfigurationCommand, type LambdaClient, ListFunctionsCommand, UpdateFunctionConfigurationCommand} from '@aws-sdk/client-lambda'
+import {ConflictError, NotFoundError, RuntimeError, ValidationError} from '../cloud-spi/errors'
+import {
+    ACCESS_POINT_PATH_PATTERN,
+    awsFileSystemsSchema,
+    FILE_SYSTEM_NAME_PATTERN,
+    FILE_SYSTEM_PERFORMANCE_MODES,
+    FILE_SYSTEM_THROUGHPUT_MODES,
+    LAMBDA_MOUNT_PATH_PATTERN,
+} from '../cloud-spi/fileSystemsSchema'
+import type {
+    AccessPointInput,
+    CloudResource,
+    CloudServiceAdapter,
+    CreateResourceInput,
+    FileSystemAttachmentInput,
+    ResourceQuery,
+    ServiceSchema,
+} from '../cloud-spi/types'
+
+/** POSIX ids EFS accepts for an access point's user and directory owner. */
+const MAX_POSIX_ID = 4_294_967_295
+
+/**
+ * Talks to Amazon EFS, verified against Floci core (community, `latest`).
+ *
+ * Notes from probing the runtime:
+ *  - Mounts are real: a Lambda function given an access point gets a Docker
+ *    volume at its mount path, so two functions on one access point share files.
+ *  - Lambda refuses a file system without a VPC config, as AWS does, so
+ *    attaching puts an un-networked function in its file system's subnets.
+ *  - Metered size is always reported as 0 bytes, so the table does not show it.
+ *  - DeleteFileSystem refuses while mount targets exist, so delete removes them
+ *    (and the access points) first, like the AWS console.
+ */
+export class AwsFileSystemsAdapter implements CloudServiceAdapter {
+    readonly cloud = 'aws' as const
+    readonly service = 'filesystems' as const
+
+    constructor(
+        private readonly efs: EFSClient,
+        private readonly lambda: LambdaClient,
+        private readonly ec2: EC2Client,
+    ) {}
+
+    schema(): ServiceSchema {
+        return awsFileSystemsSchema()
+    }
+
+    async list(query: ResourceQuery = {}): Promise<CloudResource[]> {
+        const found: FileSystemDescription[] = []
+        let marker: string | undefined
+        do {
+            const res = await this.efs.send(new DescribeFileSystemsCommand({MaxItems: 100, ...(marker ? {Marker: marker} : {})}))
+            found.push(...(res.FileSystems ?? []))
+            marker = res.NextMarker
+        } while (marker)
+
+        const search = query.search?.trim().toLowerCase()
+        return found.map((fileSystem) => toResource(fileSystem)).filter((fileSystem) => !search
+            || fileSystem.name.toLowerCase().includes(search)
+            || fileSystem.id.toLowerCase().includes(search))
+    }
+
+    async get(id: string): Promise<CloudResource | null> {
+        const fileSystem = await this.describe(id)
+        if (!fileSystem) return null
+        const [mountTargets, accessPoints] = await Promise.all([this.mountTargets(id), this.accessPoints(id)])
+        const accessPointArns = new Set(accessPoints.map((accessPoint) => accessPoint.AccessPointArn))
+        const functions = (await this.functions()).filter((fn) => (fn.FileSystemConfigs ?? []).some((config) => accessPointArns.has(config.Arn)))
+        return toResource(fileSystem, {mountTargets, accessPoints, functions})
+    }
+
+    async create(input: CreateResourceInput): Promise<CloudResource> {
+        const values = input.values
+        const name = text(values.name)
+        if (name && !new RegExp(FILE_SYSTEM_NAME_PATTERN).test(name)) throw new ValidationError('name must be up to 256 characters')
+        const performanceMode = oneOf(text(values.performanceMode) || 'generalPurpose', FILE_SYSTEM_PERFORMANCE_MODES, 'performanceMode')
+        const throughputMode = oneOf(text(values.throughputMode) || 'bursting', FILE_SYSTEM_THROUGHPUT_MODES, 'throughputMode')
+
+        const created = await this.efs.send(new CreateFileSystemCommand({
+            CreationToken: crypto.randomUUID(),
+            PerformanceMode: performanceMode,
+            ThroughputMode: throughputMode,
+            Encrypted: values.encrypted !== 'false',
+            ...(name ? {Tags: [{Key: 'Name', Value: name}]} : {}),
+        }))
+        const fileSystemId = created.FileSystemId
+        if (!fileSystemId) throw new RuntimeError('EFS did not return the new file system id')
+
+        if (text(values.mountTargets) !== 'none') {
+            for (const subnetId of await this.defaultSubnets()) {
+                await this.efs.send(new CreateMountTargetCommand({FileSystemId: fileSystemId, SubnetId: subnetId}))
+            }
+        }
+
+        const detail = await this.get(fileSystemId)
+        if (!detail) throw new RuntimeError(`EFS did not return the new file system ${fileSystemId}`)
+        return detail
+    }
+
+    async delete(id: string): Promise<void> {
+        const accessPoints = await this.accessPoints(id)
+        const accessPointArns = new Set(accessPoints.map((accessPoint) => accessPoint.AccessPointArn))
+        const users = (await this.functions()).filter((fn) => (fn.FileSystemConfigs ?? []).some((config) => accessPointArns.has(config.Arn)))
+        if (users.length > 0) {
+            throw new ConflictError(`Detach the file system from ${users.map((fn) => fn.FunctionName).join(', ')} before deleting it`)
+        }
+        for (const accessPoint of accessPoints) {
+            await this.efs.send(new DeleteAccessPointCommand({AccessPointId: accessPoint.AccessPointId}))
+        }
+        for (const mountTarget of await this.mountTargets(id)) {
+            await this.efs.send(new DeleteMountTargetCommand({MountTargetId: mountTarget.MountTargetId}))
+        }
+        await this.efs.send(new DeleteFileSystemCommand({FileSystemId: id}))
+    }
+
+    async createMountTarget(fileSystemId: string, subnetId: string): Promise<CloudResource> {
+        const subnet = subnetId.trim()
+        if (!/^subnet-[a-zA-Z0-9-]+$/.test(subnet)) throw new ValidationError('subnetId must be a subnet ID such as subnet-0abc')
+        await this.requireFileSystem(fileSystemId)
+        await this.efs.send(new CreateMountTargetCommand({FileSystemId: fileSystemId, SubnetId: subnet}))
+        return this.detail(fileSystemId)
+    }
+
+    async deleteMountTarget(fileSystemId: string, mountTargetId: string): Promise<CloudResource> {
+        const owned = (await this.mountTargets(fileSystemId)).some((mountTarget) => mountTarget.MountTargetId === mountTargetId)
+        if (!owned) throw new NotFoundError(`Mount target ${mountTargetId} is not part of ${fileSystemId}`)
+        await this.efs.send(new DeleteMountTargetCommand({MountTargetId: mountTargetId}))
+        return this.detail(fileSystemId)
+    }
+
+    async createAccessPoint(fileSystemId: string, input: AccessPointInput): Promise<CloudResource> {
+        const path = text(input.path)
+        if (!new RegExp(ACCESS_POINT_PATH_PATTERN).test(path)) throw new ValidationError('path must start with / and be up to 100 characters')
+        const uid = posixId(input.uid, 'uid')
+        const gid = posixId(input.gid, 'gid')
+        const permissions = text(input.permissions)
+        if (!/^[0-7]{3,4}$/.test(permissions)) throw new ValidationError('permissions must be octal, such as 755')
+        const name = text(input.name)
+        await this.requireFileSystem(fileSystemId)
+
+        await this.efs.send(new CreateAccessPointCommand({
+            ClientToken: crypto.randomUUID(),
+            FileSystemId: fileSystemId,
+            PosixUser: {Uid: uid, Gid: gid},
+            RootDirectory: {Path: path, CreationInfo: {OwnerUid: uid, OwnerGid: gid, Permissions: permissions}},
+            ...(name ? {Tags: [{Key: 'Name', Value: name}]} : {}),
+        }))
+        return this.detail(fileSystemId)
+    }
+
+    async deleteAccessPoint(fileSystemId: string, accessPointId: string): Promise<CloudResource> {
+        const accessPoint = (await this.accessPoints(fileSystemId)).find((candidate) => candidate.AccessPointId === accessPointId)
+        if (!accessPoint) throw new NotFoundError(`Access point ${accessPointId} is not part of ${fileSystemId}`)
+        const users = (await this.functions()).filter((fn) => (fn.FileSystemConfigs ?? []).some((config) => config.Arn === accessPoint.AccessPointArn))
+        if (users.length > 0) {
+            throw new ConflictError(`Detach ${users.map((fn) => fn.FunctionName).join(', ')} from this access point before deleting it`)
+        }
+        await this.efs.send(new DeleteAccessPointCommand({AccessPointId: accessPointId}))
+        return this.detail(fileSystemId)
+    }
+
+    async attachFileSystemToFunction(fileSystemId: string, input: FileSystemAttachmentInput): Promise<CloudResource> {
+        const mountPath = text(input.mountPath)
+        if (!new RegExp(LAMBDA_MOUNT_PATH_PATTERN).test(mountPath)) throw new ValidationError('mountPath must be under /mnt, such as /mnt/data')
+        const functionName = text(input.functionName)
+        if (!functionName) throw new ValidationError('functionName is required')
+        const accessPoint = (await this.accessPoints(fileSystemId)).find((candidate) => candidate.AccessPointId === input.accessPointId)
+        if (!accessPoint?.AccessPointArn) throw new NotFoundError(`Access point ${input.accessPointId} is not part of ${fileSystemId}`)
+
+        const fn = await this.lambda.send(new GetFunctionConfigurationCommand({FunctionName: functionName}))
+        const inVpc = (fn.VpcConfig?.SubnetIds ?? []).length > 0
+        const vpcConfig = inVpc ? undefined : await this.vpcConfigFor(fileSystemId)
+
+        await this.lambda.send(new UpdateFunctionConfigurationCommand({
+            FunctionName: functionName,
+            FileSystemConfigs: [{Arn: accessPoint.AccessPointArn, LocalMountPath: mountPath}],
+            ...(vpcConfig ? {VpcConfig: vpcConfig} : {}),
+        }))
+        return this.detail(fileSystemId)
+    }
+
+    async detachFileSystemFromFunction(fileSystemId: string, functionName: string): Promise<CloudResource> {
+        await this.lambda.send(new UpdateFunctionConfigurationCommand({FunctionName: functionName, FileSystemConfigs: []}))
+        return this.detail(fileSystemId)
+    }
+
+    private async describe(id: string): Promise<FileSystemDescription | null> {
+        try {
+            return (await this.efs.send(new DescribeFileSystemsCommand({FileSystemId: id}))).FileSystems?.[0] ?? null
+        } catch (error) {
+            if (errorName(error) === 'FileSystemNotFound') return null
+            throw error
+        }
+    }
+
+    private async requireFileSystem(id: string): Promise<void> {
+        if (!await this.describe(id)) throw new NotFoundError(`File system ${id} not found`)
+    }
+
+    private async detail(id: string): Promise<CloudResource> {
+        const detail = await this.get(id)
+        if (!detail) throw new NotFoundError(`File system ${id} not found`)
+        return detail
+    }
+
+    private async mountTargets(fileSystemId: string): Promise<MountTargetDescription[]> {
+        return (await this.efs.send(new DescribeMountTargetsCommand({FileSystemId: fileSystemId}))).MountTargets ?? []
+    }
+
+    private async accessPoints(fileSystemId: string): Promise<AccessPointDescription[]> {
+        const found: AccessPointDescription[] = []
+        let next: string | undefined
+        do {
+            const res = await this.efs.send(new DescribeAccessPointsCommand({FileSystemId: fileSystemId, ...(next ? {NextToken: next} : {})}))
+            found.push(...(res.AccessPoints ?? []))
+            next = res.NextToken
+        } while (next)
+        return found
+    }
+
+    private async functions(): Promise<FunctionConfiguration[]> {
+        const found: FunctionConfiguration[] = []
+        let marker: string | undefined
+        do {
+            const res = await this.lambda.send(new ListFunctionsCommand({MaxItems: 50, ...(marker ? {Marker: marker} : {})}))
+            found.push(...(res.Functions ?? []))
+            marker = res.NextMarker
+        } while (marker)
+        return found
+    }
+
+    /** Puts a function in the subnets its file system is reachable from, with the VPC's default security group. */
+    private async vpcConfigFor(fileSystemId: string): Promise<{SubnetIds: string[]; SecurityGroupIds: string[]}> {
+        const mountTargets = await this.mountTargets(fileSystemId)
+        const subnetIds = mountTargets.map((mountTarget) => mountTarget.SubnetId).filter((id): id is string => Boolean(id))
+        const vpcId = mountTargets.find((mountTarget) => mountTarget.VpcId)?.VpcId
+        if (subnetIds.length === 0 || !vpcId) throw new ValidationError('Add a mount target first: Lambda reaches a file system through one in its subnet')
+        const groups = await this.ec2.send(new DescribeSecurityGroupsCommand({Filters: [{Name: 'vpc-id', Values: [vpcId]}, {Name: 'group-name', Values: ['default']}]}))
+        const securityGroupId = groups.SecurityGroups?.[0]?.GroupId
+        if (!securityGroupId) throw new ValidationError(`The VPC ${vpcId} has no default security group to put the function in`)
+        return {SubnetIds: [...new Set(subnetIds)].sort(), SecurityGroupIds: [securityGroupId]}
+    }
+
+    private async defaultSubnets(): Promise<string[]> {
+        const res = await this.ec2.send(new DescribeSubnetsCommand({Filters: [{Name: 'default-for-az', Values: ['true']}]}))
+        const byZone = new Map<string, string>()
+        for (const subnet of res.Subnets ?? []) {
+            if (subnet.SubnetId && !byZone.has(subnet.AvailabilityZone ?? subnet.SubnetId)) byZone.set(subnet.AvailabilityZone ?? subnet.SubnetId, subnet.SubnetId)
+        }
+        if (byZone.size === 0) throw new ValidationError('There is no default VPC to put mount targets in; create the file system without them and add one later')
+        return [...byZone.values()].sort()
+    }
+}
+
+type FileSystemDetail = {
+    mountTargets: MountTargetDescription[]
+    accessPoints: AccessPointDescription[]
+    functions: FunctionConfiguration[]
+}
+
+function toResource(fileSystem: FileSystemDescription, detail?: FileSystemDetail): CloudResource {
+    const id = fileSystem.FileSystemId ?? ''
+    const name = fileSystem.Name || tag(fileSystem.Tags, 'Name') || id
+    return {
+        id,
+        name,
+        cloud: 'aws',
+        service: 'filesystems',
+        type: 'fileSystem',
+        region: fileSystem.FileSystemArn?.split(':')[3] || null,
+        createdAt: fileSystem.CreationTime ? fileSystem.CreationTime.toISOString() : null,
+        status: fileSystem.LifeCycleState ?? null,
+        metadata: {
+            fileSystemId: id,
+            arn: fileSystem.FileSystemArn ?? null,
+            numberOfMountTargets: fileSystem.NumberOfMountTargets ?? 0,
+            performanceMode: fileSystem.PerformanceMode ?? null,
+            throughputMode: fileSystem.ThroughputMode ?? null,
+            encrypted: fileSystem.Encrypted === true,
+            ...(detail ? {
+                mountTargets: detail.mountTargets.map((mountTarget) => ({
+                    id: mountTarget.MountTargetId ?? '',
+                    subnetId: mountTarget.SubnetId ?? null,
+                    availabilityZone: mountTarget.AvailabilityZoneName ?? null,
+                    ipAddress: mountTarget.IpAddress ?? null,
+                    vpcId: mountTarget.VpcId ?? null,
+                    state: mountTarget.LifeCycleState ?? null,
+                })),
+                accessPoints: detail.accessPoints.map((accessPoint) => ({
+                    id: accessPoint.AccessPointId ?? '',
+                    arn: accessPoint.AccessPointArn ?? null,
+                    name: accessPoint.Name || tag(accessPoint.Tags, 'Name') || null,
+                    path: accessPoint.RootDirectory?.Path ?? '/',
+                    uid: accessPoint.PosixUser?.Uid ?? null,
+                    gid: accessPoint.PosixUser?.Gid ?? null,
+                    permissions: accessPoint.RootDirectory?.CreationInfo?.Permissions ?? null,
+                    state: accessPoint.LifeCycleState ?? null,
+                })),
+                functions: detail.functions.map((fn) => {
+                    const config = fn.FileSystemConfigs?.[0]
+                    return {
+                        name: fn.FunctionName ?? '',
+                        accessPointId: config?.Arn?.split('/').pop() ?? null,
+                        mountPath: config?.LocalMountPath ?? null,
+                    }
+                }),
+            } : {}),
+        },
+    }
+}
+
+function tag(tags: Array<{Key?: string; Value?: string}> | undefined, key: string): string | undefined {
+    return tags?.find((candidate) => candidate.Key === key)?.Value
+}
+
+function posixId(value: unknown, field: string): number {
+    const id = typeof value === 'number' ? value : Number(text(value))
+    if (!Number.isInteger(id) || id < 0 || id > MAX_POSIX_ID) throw new ValidationError(`${field} must be a whole number from 0 to ${MAX_POSIX_ID}`)
+    return id
+}
+
+function oneOf<T extends string>(value: string, allowed: readonly T[], field: string): T {
+    if (!(allowed as readonly string[]).includes(value)) throw new ValidationError(`${field} must be one of ${allowed.join(', ')}`)
+    return value as T
+}
+
+function text(value: unknown): string {
+    return typeof value === 'string' ? value.trim() : typeof value === 'number' ? String(value) : ''
+}
+
+function errorName(error: unknown): string | undefined {
+    return typeof error === 'object' && error !== null ? (error as {name?: string}).name : undefined
+}

packages/api/src/aws.ts

@@ -37,6 +37,8 @@ import { CloudFrontClient } from "@aws-sdk/client-cloudfront";
 import { AutoScalingClient } from "@aws-sdk/client-auto-scaling";
 import { ACMClient } from "@aws-sdk/client-acm";
 import { PipesClient } from "@aws-sdk/client-pipes";
+import { EFSClient } from "@aws-sdk/client-efs";
+import { GlueClient } from "@aws-sdk/client-glue";
 
 const endpoint = process.env.FLOCI_ENDPOINT;
 const region = process.env.AWS_REGION || "us-east-1";
@@ -105,6 +107,8 @@ export type AwsClients = {
   autoscaling: AutoScalingClient;
   acm: ACMClient;
   pipes: PipesClient;
+  efs: EFSClient;
+  glue: GlueClient;
 };
 
 export type AwsClientName = keyof AwsClients;
@@ -157,6 +161,8 @@ function buildClients(accountId: string): AwsClients {
     autoscaling: new AutoScalingClient(base),
     acm: new ACMClient(base),
     pipes: new PipesClient(base),
+    efs: new EFSClient(base),
+    glue: new GlueClient(base),
   };
 }
 

packages/api/src/cloud-spi/dataCatalogSchema.ts

@@ -0,0 +1,68 @@
+import type {CloudProvider, FieldSchema, ServiceSchema, TableColumnSchema} from './types'
+
+/**
+ * Glue's rule for database and table names. Glue lowercases them, and Athena
+ * needs them to start with a letter or underscore to query them unquoted.
+ */
+export const CATALOG_NAME_PATTERN = '^[a-z_][a-z0-9_]{0,254}$'
+/** The data formats TheCloud's Athena engine reads from a table's S3 location. */
+export const CATALOG_TABLE_FORMATS = ['csv', 'json', 'parquet'] as const
+/** Hive column types Athena understands and the console offers. */
+export const CATALOG_COLUMN_TYPES = ['string', 'int', 'bigint', 'double', 'float', 'boolean', 'date', 'timestamp', 'decimal(10,2)'] as const
+
+const databaseColumns: TableColumnSchema[] = [
+    {name: 'name', label: 'Name'},
+    {name: 'tables', label: 'Tables', path: 'metadata.tableCount', emptyText: '—'},
+    {name: 'description', label: 'Description', path: 'metadata.description', emptyText: '—'},
+    {name: 'location', label: 'Location', path: 'metadata.locationUri', emptyText: '—'},
+    {name: 'createdAt', label: 'Created', format: 'datetime'},
+]
+
+const databaseFilters: FieldSchema[] = [{name: 'search', label: 'Search', type: 'text', required: false}]
+
+export function awsDataCatalogSchema(): ServiceSchema {
+    return {
+        cloud: 'aws',
+        service: 'datacatalog',
+        displayName: 'Glue Data Catalog databases',
+        fields: [
+            {
+                name: 'name',
+                label: 'Name',
+                type: 'text',
+                required: true,
+                description: 'Lowercase letters, numbers and underscores, starting with a letter or underscore, so Athena can query it.',
+                validation: {pattern: CATALOG_NAME_PATTERN, message: 'Use lowercase letters, numbers and underscores, starting with a letter or underscore'},
+            },
+            {name: 'description', label: 'Description', type: 'text', required: false, validation: {maxLength: 2048}},
+            {
+                name: 'locationUri',
+                label: 'Location',
+                type: 'text',
+                required: false,
+                span: true,
+                description: 'Optional S3 location for the database, such as s3://my-bucket/warehouse/.',
+                validation: {pattern: '^s3://[a-z0-9.-]{3,63}(/.*)?$', message: 'Use an S3 URI such as s3://my-bucket/warehouse/'},
+            },
+        ],
+        actions: ['list', 'create', 'delete', 'inspect'],
+        capabilities: {
+            resourceActions: [
+                {name: 'list', label: 'List databases', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'create', label: 'Create database', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'delete', label: 'Delete database', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'inspect', label: 'Inspect database', enabled: true, status: 'available', runtimeRequired: true},
+            ],
+            dataCatalogActions: [
+                {name: 'createTable', label: 'Create table', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'deleteTable', label: 'Delete table', enabled: true, status: 'available', runtimeRequired: true},
+            ],
+        },
+        filters: databaseFilters,
+        columns: databaseColumns,
+    }
+}
+
+export function dataCatalogSchemaFor(cloud: CloudProvider): ServiceSchema | null {
+    return cloud === 'aws' ? awsDataCatalogSchema() : null
+}

packages/api/src/cloud-spi/fileSystemsSchema.ts

@@ -0,0 +1,108 @@
+import type {CloudProvider, FieldSchema, ServiceSchema, TableColumnSchema} from './types'
+
+/** The Name tag EFS shows for a file system; AWS caps tag values at 256 characters. */
+export const FILE_SYSTEM_NAME_PATTERN = '^[^\\x00-\\x1f]{1,256}$'
+export const FILE_SYSTEM_PERFORMANCE_MODES = ['generalPurpose', 'maxIO'] as const
+export const FILE_SYSTEM_THROUGHPUT_MODES = ['bursting', 'elastic'] as const
+/** An access point's root: an absolute path of up to 100 characters. */
+export const ACCESS_POINT_PATH_PATTERN = '^/[^\\x00]{0,99}$'
+/** Lambda mounts file systems under /mnt only. */
+export const LAMBDA_MOUNT_PATH_PATTERN = '^/mnt/[a-zA-Z0-9-_.]{1,160}$'
+
+const fileSystemColumns: TableColumnSchema[] = [
+    {name: 'name', label: 'Name'},
+    {name: 'id', label: 'File system ID', path: 'metadata.fileSystemId'},
+    {name: 'status', label: 'State', format: 'badge'},
+    {name: 'mountTargets', label: 'Mount targets', path: 'metadata.numberOfMountTargets'},
+    {name: 'performanceMode', label: 'Performance', path: 'metadata.performanceMode'},
+    {name: 'encrypted', label: 'Encrypted', path: 'metadata.encrypted', format: 'boolean'},
+    {name: 'createdAt', label: 'Created', format: 'datetime'},
+]
+
+const fileSystemFilters: FieldSchema[] = [{name: 'search', label: 'Search', type: 'text', required: false}]
+
+export function awsFileSystemsSchema(): ServiceSchema {
+    return {
+        cloud: 'aws',
+        service: 'filesystems',
+        displayName: 'EFS file systems',
+        fields: [
+            {
+                name: 'name',
+                label: 'Name',
+                type: 'text',
+                required: false,
+                description: 'Stored as the Name tag, as the AWS console does.',
+                validation: {pattern: FILE_SYSTEM_NAME_PATTERN, message: 'Use up to 256 characters'},
+            },
+            {
+                name: 'mountTargets',
+                label: 'Mount targets',
+                type: 'select',
+                required: false,
+                defaultValue: 'default',
+                description: 'Lambda functions and ECS tasks reach a file system through a mount target in their subnet.',
+                options: [
+                    {label: 'One in each default subnet', value: 'default'},
+                    {label: 'None for now', value: 'none'},
+                ],
+            },
+            {
+                name: 'performanceMode',
+                label: 'Performance mode',
+                type: 'select',
+                required: false,
+                defaultValue: 'generalPurpose',
+                options: [
+                    {label: 'General Purpose', value: 'generalPurpose'},
+                    {label: 'Max I/O', value: 'maxIO'},
+                ],
+            },
+            {
+                name: 'throughputMode',
+                label: 'Throughput mode',
+                type: 'select',
+                required: false,
+                defaultValue: 'bursting',
+                options: [
+                    {label: 'Bursting', value: 'bursting'},
+                    {label: 'Elastic', value: 'elastic'},
+                ],
+            },
+            {
+                name: 'encrypted',
+                label: 'Encryption at rest',
+                type: 'select',
+                required: false,
+                defaultValue: 'true',
+                options: [
+                    {label: 'Encrypted', value: 'true'},
+                    {label: 'Not encrypted', value: 'false'},
+                ],
+            },
+        ],
+        actions: ['list', 'create', 'delete', 'inspect'],
+        capabilities: {
+            resourceActions: [
+                {name: 'list', label: 'List file systems', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'create', label: 'Create file system', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'delete', label: 'Delete file system', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'inspect', label: 'Inspect file system', enabled: true, status: 'available', runtimeRequired: true},
+            ],
+            fileSystemActions: [
+                {name: 'createMountTarget', label: 'Add mount target', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'deleteMountTarget', label: 'Remove mount target', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'createAccessPoint', label: 'Create access point', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'deleteAccessPoint', label: 'Delete access point', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'attachFunction', label: 'Attach to a Lambda function', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'detachFunction', label: 'Detach from a Lambda function', enabled: true, status: 'available', runtimeRequired: true},
+            ],
+        },
+        filters: fileSystemFilters,
+        columns: fileSystemColumns,
+    }
+}
+
+export function fileSystemsSchemaFor(cloud: CloudProvider): ServiceSchema | null {
+    return cloud === 'aws' ? awsFileSystemsSchema() : null
+}

packages/api/src/cloud-spi/serviceCatalog.ts

@@ -132,6 +132,13 @@ export const SERVICE_CATALOG = {
         group: 'Storage',
         order: 20,
     },
+    filesystems: {
+        displayName: 'File Systems',
+        displayNameByCloud: {aws: 'EFS'},
+        iconKey: 'filesystems',
+        group: 'Storage',
+        order: 30,
+    },
     database: {displayName: 'Database', iconKey: 'database', group: 'Databases', order: 10},
     nosql: {
         displayName: 'NoSQL',
@@ -215,6 +222,13 @@ export const SERVICE_CATALOG = {
         group: 'Analytics',
         order: 18,
     },
+    datacatalog: {
+        displayName: 'Data Catalog',
+        displayNameByCloud: {aws: 'Glue Data Catalog'},
+        iconKey: 'datacatalog',
+        group: 'Analytics',
+        order: 20,
+    },
     identity: {displayName: 'Identity', iconKey: 'iam', group: 'Security', order: 5},
     apigateway: {displayName: 'API Gateway', iconKey: 'apigateway', group: 'Integration', order: 10},
     email: {

packages/api/src/cloud-spi/types.ts

@@ -188,6 +188,8 @@ export type UserPoolActionName =
 export type DistributionActionName = 'setEnabled' | 'createInvalidation'
 export type AutoScalingActionName = 'setCapacity' | 'terminateInstance'
 export type CertificateActionName = 'download' | 'export' | 'revoke'
+export type DataCatalogActionName = 'createTable' | 'deleteTable'
+export type FileSystemActionName = 'createMountTarget' | 'deleteMountTarget' | 'createAccessPoint' | 'deleteAccessPoint' | 'attachFunction' | 'detachFunction'
 export type MonitoringActionName = 'listMetrics' | 'getMetricData' | 'alarmHistory' | 'setAlarmState' | 'setAlarmActions'
 export type HttpApiActionName =
     | 'describe'
@@ -249,6 +251,8 @@ export interface ServiceSchema {
         distributionActions?: CapabilitySchema<DistributionActionName>[]
         autoScalingActions?: CapabilitySchema<AutoScalingActionName>[]
         certificateActions?: CapabilitySchema<CertificateActionName>[]
+        fileSystemActions?: CapabilitySchema<FileSystemActionName>[]
+        dataCatalogActions?: CapabilitySchema<DataCatalogActionName>[]
         monitoringActions?: CapabilitySchema<MonitoringActionName>[]
         /** API Gateway v2 (HTTP and WebSocket APIs): what the routes, stages and security panel can do. */
         httpApiActions?: CapabilitySchema<HttpApiActionName>[]
@@ -546,6 +550,40 @@ export interface AutoScalingCapacityInput {
     maxSize?: number
 }
 
+export interface AccessPointInput {
+    name?: string
+    /** Where the access point's root sits inside the file system; created on first use. */
+    path: string
+    uid: number
+    gid: number
+    /** Octal permissions for the root directory when EFS creates it, such as 755. */
+    permissions: string
+}
+
+export interface CatalogColumnInput {
+    name: string
+    type: string
+}
+
+export interface CatalogTableInput {
+    name: string
+    description?: string
+    /** The S3 prefix holding the table's files, such as s3://bucket/orders/. */
+    location: string
+    format: 'csv' | 'json' | 'parquet'
+    /** CSV only: the field separator, a comma unless given. */
+    delimiter?: string
+    /** CSV only: whether the first line of each file is a header to skip. */
+    headerRow?: boolean
+    columns: CatalogColumnInput[]
+}
+
+export interface FileSystemAttachmentInput {
+    accessPointId: string
+    functionName: string
+    mountPath: string
+}
+
 export interface DistributionInvalidation {
     id: string
     status: string
@@ -1217,6 +1255,15 @@ export interface CloudServiceAdapter {
     /** With `replace`, the group launches a new instance in its place; otherwise desired capacity drops by one. */
     terminateAutoScalingInstance?(groupName: string, instanceId: string, replace: boolean): Promise<void>
     getCertificatePem?(certificateId: string): Promise<CertificatePem>
+    createCatalogTable?(databaseName: string, input: CatalogTableInput): Promise<CloudResource>
+    deleteCatalogTable?(databaseName: string, tableName: string): Promise<CloudResource>
+    createMountTarget?(fileSystemId: string, subnetId: string): Promise<CloudResource>
+    deleteMountTarget?(fileSystemId: string, mountTargetId: string): Promise<CloudResource>
+    createAccessPoint?(fileSystemId: string, input: AccessPointInput): Promise<CloudResource>
+    deleteAccessPoint?(fileSystemId: string, accessPointId: string): Promise<CloudResource>
+    /** Mounts one of the file system's access points into a Lambda function, as UpdateFunctionConfiguration does. */
+    attachFileSystemToFunction?(fileSystemId: string, input: FileSystemAttachmentInput): Promise<CloudResource>
+    detachFileSystemFromFunction?(fileSystemId: string, functionName: string): Promise<CloudResource>
     exportCertificate?(certificateId: string, passphrase: string): Promise<ExportedCertificate>
     revokeCertificate?(certificateId: string, reason: CertificateRevocationReason): Promise<CloudResource>
     updateUserPoolClientOAuth?(poolId: string, clientId: string, input: UpdateUserPoolClientOAuthInput): Promise<UserPoolClientSettings>

packages/api/src/cloudProxy.test.ts

@@ -2,7 +2,7 @@ import {describe, expect, test} from 'bun:test'
 import {createCloudAdapterRegistry} from './cloudProxy'
 import {checkChildCapabilities} from './cloud-spi/childCapabilities'
 import {isServiceType} from './cloud-spi/serviceCatalog'
-import type {AutoScalingActionName, CloudProvider, CloudServiceAdapter, CloudServiceType, CertificateActionName, DatabaseActionName, DistributionActionName, HttpApiActionName, KubernetesActionName, MonitoringActionName, ResourceActionName, UserPoolActionName} from './cloud-spi/types'
+import type {AutoScalingActionName, CloudProvider, CloudServiceAdapter, CloudServiceType, CertificateActionName, DatabaseActionName, DataCatalogActionName, DistributionActionName, FileSystemActionName, HttpApiActionName, KubernetesActionName, MonitoringActionName, ResourceActionName, UserPoolActionName} from './cloud-spi/types'
 
 /**
  * Guards the schema-to-implementation contract for every registered adapter.
@@ -81,6 +81,20 @@ const METHOD_FOR_CERTIFICATE_ACTION: Record<CertificateActionName, keyof CloudSe
     revoke: 'revokeCertificate',
 }
 
+const METHOD_FOR_DATA_CATALOG_ACTION: Record<DataCatalogActionName, keyof CloudServiceAdapter> = {
+    createTable: 'createCatalogTable',
+    deleteTable: 'deleteCatalogTable',
+}
+
+const METHOD_FOR_FILE_SYSTEM_ACTION: Record<FileSystemActionName, keyof CloudServiceAdapter> = {
+    createMountTarget: 'createMountTarget',
+    deleteMountTarget: 'deleteMountTarget',
+    createAccessPoint: 'createAccessPoint',
+    deleteAccessPoint: 'deleteAccessPoint',
+    attachFunction: 'attachFileSystemToFunction',
+    detachFunction: 'detachFileSystemFromFunction',
+}
+
 const METHOD_FOR_AUTO_SCALING_ACTION: Record<AutoScalingActionName, keyof CloudServiceAdapter> = {
     setCapacity: 'setAutoScalingCapacity',
     terminateInstance: 'terminateAutoScalingInstance',
@@ -217,6 +231,24 @@ describe('registered adapters honour their schema', () => {
                 ).toBe('function')
             }
 
+            const dataCatalogClaims = (adapter.schema().capabilities?.dataCatalogActions ?? []).filter((capability) => capability.status === 'available')
+            for (const capability of dataCatalogClaims) {
+                const method = METHOD_FOR_DATA_CATALOG_ACTION[capability.name]
+                expect(
+                    typeof adapter[method],
+                    `${label} advertises ${capability.name} as available but has no ${String(method)}()`,
+                ).toBe('function')
+            }
+
+            const fileSystemClaims = (adapter.schema().capabilities?.fileSystemActions ?? []).filter((capability) => capability.status === 'available')
+            for (const capability of fileSystemClaims) {
+                const method = METHOD_FOR_FILE_SYSTEM_ACTION[capability.name]
+                expect(
+                    typeof adapter[method],
+                    `${label} advertises ${capability.name} as available but has no ${String(method)}()`,
+                ).toBe('function')
+            }
+
             const distributionClaims = (adapter.schema().capabilities?.distributionActions ?? []).filter((capability) => capability.status === 'available')
             for (const capability of distributionClaims) {
                 const method = METHOD_FOR_DISTRIBUTION_ACTION[capability.name]
@@ -240,6 +272,8 @@ describe('registered adapters honour their schema', () => {
                 ...(adapter.schema().capabilities?.userPoolActions ?? []),
                 ...(adapter.schema().capabilities?.distributionActions ?? []),
                 ...(adapter.schema().capabilities?.autoScalingActions ?? []),
+                ...(adapter.schema().capabilities?.fileSystemActions ?? []),
+                ...(adapter.schema().capabilities?.dataCatalogActions ?? []),
                 ...(adapter.schema().capabilities?.certificateActions ?? []),
                 ...(adapter.schema().capabilities?.monitoringActions ?? []),
                 ...(adapter.schema().capabilities?.httpApiActions ?? []),

packages/api/src/cloudProxy.ts

@@ -53,6 +53,8 @@ import {AwsCdnAdapter} from './adapter-aws/AwsCdnAdapter'
 import {AwsAutoScalingAdapter} from './adapter-aws/AwsAutoScalingAdapter'
 import {AwsCertificatesAdapter} from './adapter-aws/AwsCertificatesAdapter'
 import {AwsPipesAdapter} from './adapter-aws/AwsPipesAdapter'
+import {AwsFileSystemsAdapter} from './adapter-aws/AwsFileSystemsAdapter'
+import {AwsDataCatalogAdapter} from './adapter-aws/AwsDataCatalogAdapter'
 import {AwsMonitoringAdapter} from './adapter-aws/AwsMonitoringAdapter'
 import {awsClientsForAccount, resolveAccountId} from './aws'
 import {createEc2Service} from './services/ec2'
@@ -109,6 +111,8 @@ export function createCloudAdapterRegistry(accountId?: string | null): CloudAdap
         new AwsAutoScalingAdapter(clients.autoscaling, clients.ec2),
         new AwsCertificatesAdapter(clients.acm, resolveAccountId(accountId)),
         new AwsPipesAdapter(clients.pipes),
+        new AwsFileSystemsAdapter(clients.efs, clients.lambda, clients.ec2),
+        new AwsDataCatalogAdapter(clients.glue),
         new AwsMonitoringAdapter(clients.cloudwatch),
         new AzureStorageAdapter(),
         new AzureServiceBusAdapter(),

packages/api/src/routes/clouds.test.ts

@@ -19,6 +19,8 @@ import {awsSesEmailSchema} from '../cloud-spi/emailSchema'
 import {awsUserPoolsSchema} from '../cloud-spi/userPoolsSchema'
 import {awsCdnSchema} from '../cloud-spi/cdnSchema'
 import {awsAutoScalingSchema} from '../cloud-spi/autoScalingSchema'
+import {awsFileSystemsSchema} from '../cloud-spi/fileSystemsSchema'
+import {awsDataCatalogSchema} from '../cloud-spi/dataCatalogSchema'
 import {awsCertificatesSchema} from '../cloud-spi/certificatesSchema'
 import {awsMonitoringSchema} from '../cloud-spi/monitoringSchema'
 import {awsAppConfigSchema} from '../cloud-spi/appConfigSchema'
@@ -875,6 +877,51 @@ describe('cloud schema routes', () => {
         expect(calls).toEqual([['capacity', 'web-asg', {desiredCapacity: 3}], ['terminate', 'web-asg', 'i-abc', true]])
     })
 
+    test('creates and deletes catalog tables through the Glue adapter', async () => {
+        const calls: unknown[] = []
+        const database = {id: 'shop', name: 'shop', cloud: 'aws' as const, service: 'datacatalog' as const, type: 'glueDatabase', region: null, createdAt: null, metadata: {}}
+        const app = appWithRoutes([mockAdapter('aws', {
+            service: 'datacatalog',
+            schema: awsDataCatalogSchema,
+            createCatalogTable: async (id, input) => { calls.push(['create', id, input.name, input.format]); return database },
+            deleteCatalogTable: async (id, tableName) => { calls.push(['delete', id, tableName]); return database },
+        })])
+        const base = '/api/clouds/aws/services/datacatalog/resources/shop/tables'
+
+        const created = await app.request(base, {method: 'POST', headers: {'content-type': 'application/json'}, body: JSON.stringify({name: 'orders', location: 's3://data/orders/', format: 'csv', columns: [{name: 'id', type: 'int'}]})})
+        expect(created.status).toBe(201)
+        expect((await app.request(`${base}/orders`, {method: 'DELETE'})).status).toBe(200)
+        expect(calls).toEqual([['create', 'shop', 'orders', 'csv'], ['delete', 'shop', 'orders']])
+    })
+
+    test('manages mount targets, access points and function mounts through the EFS adapter', async () => {
+        const calls: unknown[] = []
+        const fileSystem = {id: 'fs-1', name: 'shared', cloud: 'aws' as const, service: 'filesystems' as const, type: 'fileSystem', region: null, createdAt: null, metadata: {}}
+        const app = appWithRoutes([mockAdapter('aws', {
+            service: 'filesystems',
+            schema: awsFileSystemsSchema,
+            createMountTarget: async (id, subnetId) => { calls.push(['mount', id, subnetId]); return fileSystem },
+            deleteMountTarget: async (id, mountTargetId) => { calls.push(['unmount', id, mountTargetId]); return fileSystem },
+            createAccessPoint: async (id, input) => { calls.push(['ap', id, input.path]); return fileSystem },
+            deleteAccessPoint: async (id, accessPointId) => { calls.push(['delete-ap', id, accessPointId]); return fileSystem },
+            attachFileSystemToFunction: async (id, input) => { calls.push(['attach', id, input.functionName, input.mountPath]); return fileSystem },
+            detachFileSystemFromFunction: async (id, functionName) => { calls.push(['detach', id, functionName]); return fileSystem },
+        })])
+        const json = (method: string, body: unknown) => ({method, headers: {'content-type': 'application/json'}, body: JSON.stringify(body)})
+        const base = '/api/clouds/aws/services/filesystems/resources/fs-1'
+
+        expect((await app.request(`${base}/mount-targets`, json('POST', {subnetId: 'subnet-a'}))).status).toBe(201)
+        expect((await app.request(`${base}/mount-targets/fsmt-1`, {method: 'DELETE'})).status).toBe(200)
+        expect((await app.request(`${base}/access-points`, json('POST', {path: '/app', uid: 1000, gid: 1000, permissions: '755'}))).status).toBe(201)
+        expect((await app.request(`${base}/access-points/fsap-1`, {method: 'DELETE'})).status).toBe(200)
+        expect((await app.request(`${base}/functions`, json('POST', {accessPointId: 'fsap-1', functionName: 'writer', mountPath: '/mnt/share'}))).status).toBe(200)
+        expect((await app.request(`${base}/functions/writer`, {method: 'DELETE'})).status).toBe(200)
+        expect(calls).toEqual([
+            ['mount', 'fs-1', 'subnet-a'], ['unmount', 'fs-1', 'fsmt-1'], ['ap', 'fs-1', '/app'], ['delete-ap', 'fs-1', 'fsap-1'],
+            ['attach', 'fs-1', 'writer', '/mnt/share'], ['detach', 'fs-1', 'writer'],
+        ])
+    })
+
     test('clears the SES mailbox through the email adapter', async () => {
         let cleared = false
         const app = appWithRoutes([mockAdapter('aws', {

packages/api/src/routes/clouds.ts

@@ -3,6 +3,9 @@ import type {Context} from 'hono'
 import type {
     AlarmStateValue,
     AutoScalingCapacityInput,
+    AccessPointInput,
+    CatalogTableInput,
+    FileSystemAttachmentInput,
     CertificateRevocationReason,
     CloudProvider,
     CloudServiceType,
@@ -554,6 +557,65 @@ export function createCloudRoutes(injectedService?: CloudProxyService) {
         })
     })
 
+    app.post('/:cloud/services/datacatalog/resources/:id/tables', async (c) => {
+        const cloud = c.req.param('cloud') as CloudProvider
+        if (!isCloudProvider(cloud)) return c.json({error: 'Unknown cloud'}, 404)
+
+        return withRuntime(c, async () => c.json(await svc(c).createCatalogTable(cloud, c.req.param('id'), await c.req.json<CatalogTableInput>()), 201))
+    })
+
+    app.delete('/:cloud/services/datacatalog/resources/:id/tables/:tableName', async (c) => {
+        const cloud = c.req.param('cloud') as CloudProvider
+        if (!isCloudProvider(cloud)) return c.json({error: 'Unknown cloud'}, 404)
+
+        return withRuntime(c, async () => c.json(await svc(c).deleteCatalogTable(cloud, c.req.param('id'), c.req.param('tableName'))))
+    })
+
+    app.post('/:cloud/services/filesystems/resources/:id/mount-targets', async (c) => {
+        const cloud = c.req.param('cloud') as CloudProvider
+        if (!isCloudProvider(cloud)) return c.json({error: 'Unknown cloud'}, 404)
+
+        return withRuntime(c, async () => {
+            const body = await c.req.json<{subnetId?: string}>()
+            return c.json(await svc(c).createMountTarget(cloud, c.req.param('id'), body.subnetId ?? ''), 201)
+        })
+    })
+
+    app.delete('/:cloud/services/filesystems/resources/:id/mount-targets/:mountTargetId', async (c) => {
+        const cloud = c.req.param('cloud') as CloudProvider
+        if (!isCloudProvider(cloud)) return c.json({error: 'Unknown cloud'}, 404)
+
+        return withRuntime(c, async () => c.json(await svc(c).deleteMountTarget(cloud, c.req.param('id'), c.req.param('mountTargetId'))))
+    })
+
+    app.post('/:cloud/services/filesystems/resources/:id/access-points', async (c) => {
+        const cloud = c.req.param('cloud') as CloudProvider
+        if (!isCloudProvider(cloud)) return c.json({error: 'Unknown cloud'}, 404)
+
+        return withRuntime(c, async () => c.json(await svc(c).createAccessPoint(cloud, c.req.param('id'), await c.req.json<AccessPointInput>()), 201))
+    })
+
+    app.delete('/:cloud/services/filesystems/resources/:id/access-points/:accessPointId', async (c) => {
+        const cloud = c.req.param('cloud') as CloudProvider
+        if (!isCloudProvider(cloud)) return c.json({error: 'Unknown cloud'}, 404)
+
+        return withRuntime(c, async () => c.json(await svc(c).deleteAccessPoint(cloud, c.req.param('id'), c.req.param('accessPointId'))))
+    })
+
+    app.post('/:cloud/services/filesystems/resources/:id/functions', async (c) => {
+        const cloud = c.req.param('cloud') as CloudProvider
+        if (!isCloudProvider(cloud)) return c.json({error: 'Unknown cloud'}, 404)
+
+        return withRuntime(c, async () => c.json(await svc(c).attachFileSystemToFunction(cloud, c.req.param('id'), await c.req.json<FileSystemAttachmentInput>())))
+    })
+
+    app.delete('/:cloud/services/filesystems/resources/:id/functions/:functionName', async (c) => {
+        const cloud = c.req.param('cloud') as CloudProvider
+        if (!isCloudProvider(cloud)) return c.json({error: 'Unknown cloud'}, 404)
+
+        return withRuntime(c, async () => c.json(await svc(c).detachFileSystemFromFunction(cloud, c.req.param('id'), c.req.param('functionName'))))
+    })
+
     app.put('/:cloud/services/autoscaling/resources/:id/capacity', async (c) => {
         const cloud = c.req.param('cloud') as CloudProvider
         if (!isCloudProvider(cloud)) return c.json({error: 'Unknown cloud'}, 404)

packages/api/src/service/CloudProxyService.ts

@@ -94,6 +94,9 @@ import type {
     UserPoolClientSettings,
     DistributionInvalidation,
     AutoScalingCapacityInput,
+    AccessPointInput,
+    CatalogTableInput,
+    FileSystemAttachmentInput,
     CertificatePem,
     CertificateRevocationReason,
     ExportedCertificate,
@@ -964,6 +967,54 @@ export class CloudProxyService {
         return adapter.revokeCertificate(certificateId, reason)
     }
 
+    async createCatalogTable(cloud: CloudProvider, databaseName: string, input: CatalogTableInput): Promise<CloudResource> {
+        const adapter = this.requireAdapter(cloud, 'datacatalog')
+        if (!adapter.createCatalogTable) throw new NotSupportedError(`Creating tables is not supported for ${cloud}/datacatalog`)
+        return adapter.createCatalogTable(databaseName, input)
+    }
+
+    async deleteCatalogTable(cloud: CloudProvider, databaseName: string, tableName: string): Promise<CloudResource> {
+        const adapter = this.requireAdapter(cloud, 'datacatalog')
+        if (!adapter.deleteCatalogTable) throw new NotSupportedError(`Deleting tables is not supported for ${cloud}/datacatalog`)
+        return adapter.deleteCatalogTable(databaseName, tableName)
+    }
+
+    async createMountTarget(cloud: CloudProvider, fileSystemId: string, subnetId: string): Promise<CloudResource> {
+        const adapter = this.requireAdapter(cloud, 'filesystems')
+        if (!adapter.createMountTarget) throw new NotSupportedError(`Mount targets are not supported for ${cloud}/filesystems`)
+        return adapter.createMountTarget(fileSystemId, subnetId)
+    }
+
+    async deleteMountTarget(cloud: CloudProvider, fileSystemId: string, mountTargetId: string): Promise<CloudResource> {
+        const adapter = this.requireAdapter(cloud, 'filesystems')
+        if (!adapter.deleteMountTarget) throw new NotSupportedError(`Mount targets are not supported for ${cloud}/filesystems`)
+        return adapter.deleteMountTarget(fileSystemId, mountTargetId)
+    }
+
+    async createAccessPoint(cloud: CloudProvider, fileSystemId: string, input: AccessPointInput): Promise<CloudResource> {
+        const adapter = this.requireAdapter(cloud, 'filesystems')
+        if (!adapter.createAccessPoint) throw new NotSupportedError(`Access points are not supported for ${cloud}/filesystems`)
+        return adapter.createAccessPoint(fileSystemId, input)
+    }
+
+    async deleteAccessPoint(cloud: CloudProvider, fileSystemId: string, accessPointId: string): Promise<CloudResource> {
+        const adapter = this.requireAdapter(cloud, 'filesystems')
+        if (!adapter.deleteAccessPoint) throw new NotSupportedError(`Access points are not supported for ${cloud}/filesystems`)
+        return adapter.deleteAccessPoint(fileSystemId, accessPointId)
+    }
+
+    async attachFileSystemToFunction(cloud: CloudProvider, fileSystemId: string, input: FileSystemAttachmentInput): Promise<CloudResource> {
+        const adapter = this.requireAdapter(cloud, 'filesystems')
+        if (!adapter.attachFileSystemToFunction) throw new NotSupportedError(`Attaching file systems is not supported for ${cloud}/filesystems`)
+        return adapter.attachFileSystemToFunction(fileSystemId, input)
+    }
+
+    async detachFileSystemFromFunction(cloud: CloudProvider, fileSystemId: string, functionName: string): Promise<CloudResource> {
+        const adapter = this.requireAdapter(cloud, 'filesystems')
+        if (!adapter.detachFileSystemFromFunction) throw new NotSupportedError(`Detaching file systems is not supported for ${cloud}/filesystems`)
+        return adapter.detachFileSystemFromFunction(fileSystemId, functionName)
+    }
+
     async setAutoScalingCapacity(cloud: CloudProvider, groupName: string, input: AutoScalingCapacityInput): Promise<CloudResource> {
         const adapter = this.requireAdapter(cloud, 'autoscaling')
         if (!adapter.setAutoScalingCapacity) throw new NotSupportedError(`Changing capacity is not supported for ${cloud}/autoscaling`)

packages/frontend/src/api/api.ts

@@ -155,6 +155,18 @@ export const apiEndpointKeys = {
       export: "clouds.services.certificates.export",
       revoke: "clouds.services.certificates.revoke",
     },
+    datacatalog: {
+      tables: "clouds.services.datacatalog.tables",
+      table: "clouds.services.datacatalog.table",
+    },
+    filesystems: {
+      mountTargets: "clouds.services.filesystems.mountTargets",
+      mountTarget: "clouds.services.filesystems.mountTarget",
+      accessPoints: "clouds.services.filesystems.accessPoints",
+      accessPoint: "clouds.services.filesystems.accessPoint",
+      functions: "clouds.services.filesystems.functions",
+      function: "clouds.services.filesystems.function",
+    },
     autoscaling: {
       capacity: "clouds.services.autoscaling.capacity",
       terminate: "clouds.services.autoscaling.instances.terminate",
@@ -956,6 +968,62 @@ export const endpointRegistry: EndpointRegistry = new Map([
       method: "POST",
     },
   ],
+  [
+    apiEndpointKeys.clouds.datacatalog.tables,
+    {
+      path: "/clouds/:cloud/services/datacatalog/resources/:id/tables",
+      method: "POST",
+    },
+  ],
+  [
+    apiEndpointKeys.clouds.datacatalog.table,
+    {
+      path: "/clouds/:cloud/services/datacatalog/resources/:id/tables/:tableName",
+      method: "DELETE",
+    },
+  ],
+  [
+    apiEndpointKeys.clouds.filesystems.mountTargets,
+    {
+      path: "/clouds/:cloud/services/filesystems/resources/:id/mount-targets",
+      method: "POST",
+    },
+  ],
+  [
+    apiEndpointKeys.clouds.filesystems.mountTarget,
+    {
+      path: "/clouds/:cloud/services/filesystems/resources/:id/mount-targets/:mountTargetId",
+      method: "DELETE",
+    },
+  ],
+  [
+    apiEndpointKeys.clouds.filesystems.accessPoints,
+    {
+      path: "/clouds/:cloud/services/filesystems/resources/:id/access-points",
+      method: "POST",
+    },
+  ],
+  [
+    apiEndpointKeys.clouds.filesystems.accessPoint,
+    {
+      path: "/clouds/:cloud/services/filesystems/resources/:id/access-points/:accessPointId",
+      method: "DELETE",
+    },
+  ],
+  [
+    apiEndpointKeys.clouds.filesystems.functions,
+    {
+      path: "/clouds/:cloud/services/filesystems/resources/:id/functions",
+      method: "POST",
+    },
+  ],
+  [
+    apiEndpointKeys.clouds.filesystems.function,
+    {
+      path: "/clouds/:cloud/services/filesystems/resources/:id/functions/:functionName",
+      method: "DELETE",
+    },
+  ],
   [
     apiEndpointKeys.clouds.autoscaling.capacity,
     {

packages/frontend/src/api/cloudProxyClient.ts

@@ -34,6 +34,9 @@ import type {
   UserPoolClientSettings,
   DistributionInvalidation,
   AutoScalingCapacityInput,
+  AccessPointInput,
+  CatalogTableInput,
+  FileSystemAttachmentInput,
   CertificatePem,
   CertificateRevocationReason,
   ExportedCertificate,
@@ -1721,6 +1724,110 @@ export async function revokeCertificate(
   return res.data;
 }
 
+export async function createCatalogTable(
+  cloud: CloudProvider,
+  databaseName: string,
+  input: CatalogTableInput,
+): Promise<CloudResource> {
+  const res = await apiClient.call<CloudResource, CatalogTableInput>(
+    apiEndpointKeys.clouds.datacatalog.tables,
+    requestOptions(cloud, "datacatalog", { body: input }),
+    { cloud, id: databaseName },
+  );
+  return res.data;
+}
+
+export async function deleteCatalogTable(
+  cloud: CloudProvider,
+  databaseName: string,
+  tableName: string,
+): Promise<CloudResource> {
+  const res = await apiClient.call<CloudResource>(
+    apiEndpointKeys.clouds.datacatalog.table,
+    requestOptions(cloud, "datacatalog"),
+    { cloud, id: databaseName, tableName },
+  );
+  return res.data;
+}
+
+export async function createMountTarget(
+  cloud: CloudProvider,
+  fileSystemId: string,
+  subnetId: string,
+): Promise<CloudResource> {
+  const res = await apiClient.call<CloudResource, { subnetId: string }>(
+    apiEndpointKeys.clouds.filesystems.mountTargets,
+    requestOptions(cloud, "filesystems", { body: { subnetId } }),
+    { cloud, id: fileSystemId },
+  );
+  return res.data;
+}
+
+export async function deleteMountTarget(
+  cloud: CloudProvider,
+  fileSystemId: string,
+  mountTargetId: string,
+): Promise<CloudResource> {
+  const res = await apiClient.call<CloudResource>(
+    apiEndpointKeys.clouds.filesystems.mountTarget,
+    requestOptions(cloud, "filesystems"),
+    { cloud, id: fileSystemId, mountTargetId },
+  );
+  return res.data;
+}
+
+export async function createAccessPoint(
+  cloud: CloudProvider,
+  fileSystemId: string,
+  input: AccessPointInput,
+): Promise<CloudResource> {
+  const res = await apiClient.call<CloudResource, AccessPointInput>(
+    apiEndpointKeys.clouds.filesystems.accessPoints,
+    requestOptions(cloud, "filesystems", { body: input }),
+    { cloud, id: fileSystemId },
+  );
+  return res.data;
+}
+
+export async function deleteAccessPoint(
+  cloud: CloudProvider,
+  fileSystemId: string,
+  accessPointId: string,
+): Promise<CloudResource> {
+  const res = await apiClient.call<CloudResource>(
+    apiEndpointKeys.clouds.filesystems.accessPoint,
+    requestOptions(cloud, "filesystems"),
+    { cloud, id: fileSystemId, accessPointId },
+  );
+  return res.data;
+}
+
+export async function attachFileSystemToFunction(
+  cloud: CloudProvider,
+  fileSystemId: string,
+  input: FileSystemAttachmentInput,
+): Promise<CloudResource> {
+  const res = await apiClient.call<CloudResource, FileSystemAttachmentInput>(
+    apiEndpointKeys.clouds.filesystems.functions,
+    requestOptions(cloud, "filesystems", { body: input }),
+    { cloud, id: fileSystemId },
+  );
+  return res.data;
+}
+
+export async function detachFileSystemFromFunction(
+  cloud: CloudProvider,
+  fileSystemId: string,
+  functionName: string,
+): Promise<CloudResource> {
+  const res = await apiClient.call<CloudResource>(
+    apiEndpointKeys.clouds.filesystems.function,
+    requestOptions(cloud, "filesystems"),
+    { cloud, id: fileSystemId, functionName },
+  );
+  return res.data;
+}
+
 export async function setAutoScalingCapacity(
   cloud: CloudProvider,
   groupName: string,

packages/frontend/src/components/DataCatalogPanel.test.tsx

@@ -0,0 +1,90 @@
+import {QueryClient, QueryClientProvider} from '@tanstack/react-query'
+import {render, screen, within} from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import {beforeEach, expect, test, vi} from 'vitest'
+import {DataCatalogPanel} from './DataCatalogPanel'
+import type {CloudResource} from '@/types/resource'
+
+const api = vi.hoisted(() => ({
+    getCloudResource: vi.fn(),
+    createCatalogTable: vi.fn(),
+    deleteCatalogTable: vi.fn(),
+}))
+
+vi.mock('@/api/cloudProxyClient', () => api)
+vi.mock('@/lib/accountStore', () => ({useAccountId: () => '000000000000'}))
+
+function database(tables: unknown[] = [{
+    name: 'orders', description: null, format: 'csv', location: 's3://data/orders/', delimiter: ';', headerRow: true,
+    columns: [{name: 'id', type: 'int'}, {name: 'amount', type: 'double'}], partitionKeys: [], createdAt: null, updatedAt: null,
+}]): CloudResource {
+    return {id: 'shop', name: 'shop', cloud: 'aws', service: 'datacatalog', type: 'glueDatabase', region: null, createdAt: null, metadata: {description: 'Orders', tableCount: tables.length, tables}}
+}
+
+function renderPanel(resource: CloudResource) {
+    api.getCloudResource.mockResolvedValue(resource)
+    const client = new QueryClient({defaultOptions: {queries: {retry: false}}})
+    return render(<QueryClientProvider client={client}><DataCatalogPanel resource={resource} runtimeReachable/></QueryClientProvider>)
+}
+
+beforeEach(() => {
+    vi.clearAllMocks()
+    api.createCatalogTable.mockResolvedValue(database())
+    api.deleteCatalogTable.mockResolvedValue(database([]))
+})
+
+test('lists tables with their format, location and columns', async () => {
+    renderPanel(database())
+
+    const row = (await screen.findByText('orders')).closest('tr') as HTMLElement
+    expect(within(row).getByText('s3://data/orders/')).toBeInTheDocument()
+    expect(within(row).getByText('semicolon-separated, header row')).toBeInTheDocument()
+    expect(within(row).getByText('amount')).toBeInTheDocument()
+})
+
+test('creates a CSV table from the columns entered', async () => {
+    const user = userEvent.setup()
+    renderPanel(database([]))
+
+    const form = await screen.findByRole('form', {name: 'Create table'})
+    await user.type(within(form).getByLabelText('Name'), 'events')
+    const location = within(form).getByLabelText('S3 location')
+    await user.clear(location)
+    await user.type(location, 's3://data/events/')
+    await user.type(within(form).getByLabelText('Column 1 name'), 'id')
+    await user.selectOptions(within(form).getByLabelText('Column 1 type'), 'int')
+    await user.click(within(form).getByRole('button', {name: 'Add column'}))
+    await user.type(within(form).getByLabelText('Column 2 name'), 'kind')
+    await user.click(within(form).getByRole('button', {name: 'Create table'}))
+
+    expect(api.createCatalogTable).toHaveBeenCalledWith('aws', 'shop', {
+        name: 'events', location: 's3://data/events/', format: 'csv', delimiter: ',', headerRow: true,
+        columns: [{name: 'id', type: 'int'}, {name: 'kind', type: 'string'}],
+    })
+    expect(await screen.findByText('Created table events. Athena can query it now.')).toBeInTheDocument()
+})
+
+test('JSON tables need no delimiter or header', async () => {
+    const user = userEvent.setup()
+    renderPanel(database([]))
+
+    const form = await screen.findByRole('form', {name: 'Create table'})
+    await user.selectOptions(within(form).getByLabelText('Format'), 'json')
+    expect(within(form).queryByLabelText('Delimiter')).not.toBeInTheDocument()
+    await user.type(within(form).getByLabelText('Name'), 'events')
+    await user.type(within(form).getByLabelText('S3 location'), 'data/events/')
+    await user.type(within(form).getByLabelText('Column 1 name'), 'kind')
+    await user.click(within(form).getByRole('button', {name: 'Create table'}))
+
+    expect(api.createCatalogTable).toHaveBeenCalledWith('aws', 'shop', {name: 'events', location: 's3://data/events/', format: 'json', columns: [{name: 'kind', type: 'string'}]})
+})
+
+test('deletes a table after confirming', async () => {
+    const user = userEvent.setup()
+    vi.spyOn(window, 'confirm').mockReturnValue(true)
+    renderPanel(database())
+
+    await user.click(await screen.findByRole('button', {name: 'Delete table orders'}))
+    expect(api.deleteCatalogTable).toHaveBeenCalledWith('aws', 'shop', 'orders')
+    expect(await screen.findByText('Deleted table orders. Its files stay in S3.')).toBeInTheDocument()
+})

packages/frontend/src/components/DataCatalogPanel.tsx

@@ -0,0 +1,145 @@
+import {Plus, RefreshCw, X} from 'lucide-react'
+import {useMutation, useQuery, useQueryClient} from '@tanstack/react-query'
+import {useEffect, useState} from 'react'
+import {createCatalogTable, deleteCatalogTable, getCloudResource} from '@/api/cloudProxyClient'
+import {cloudQueryKeys} from '@/api/queries/cloudQueries'
+import {useAccountId} from '@/lib/accountStore'
+import {formatDateTime} from '@/lib/format'
+import type {CatalogTableInput, CloudResource} from '@/types/resource'
+
+type Props = {
+    resource?: CloudResource
+    runtimeReachable: boolean
+}
+
+type Column = {name: string; type: string}
+type CatalogTable = {
+    name: string
+    description: string | null
+    format: string
+    location: string | null
+    delimiter: string | null
+    headerRow: boolean
+    columns: Column[]
+    partitionKeys: Column[]
+    updatedAt: string | null
+    createdAt: string | null
+}
+type TableForm = {name: string; location: string; format: CatalogTableInput['format']; delimiter: string; headerRow: boolean; columns: Column[]}
+
+/** Matches the types the API accepts; decimal(p,s) can also be typed in by hand through the API. */
+const COLUMN_TYPES = ['string', 'int', 'bigint', 'double', 'float', 'boolean', 'date', 'timestamp', 'decimal(10,2)']
+const FORMAT_LABELS: Record<string, string> = {csv: 'CSV', json: 'JSON lines', parquet: 'Parquet', iceberg: 'Iceberg'}
+const DELIMITER_NAMES: Record<string, string> = {',': 'comma-separated', ';': 'semicolon-separated', '\t': 'tab-separated', '|': 'pipe-separated'}
+const delimiterLabel = (delimiter: string | null) => DELIMITER_NAMES[delimiter ?? ','] ?? `separated by "${delimiter}"`
+const emptyForm = (): TableForm => ({name: '', location: 's3://', format: 'csv', delimiter: ',', headerRow: true, columns: [{name: '', type: 'string'}]})
+
+export function DataCatalogPanel({resource, runtimeReachable}: Props) {
+    const accountId = useAccountId()
+    const queryClient = useQueryClient()
+    const [form, setForm] = useState<TableForm>(emptyForm)
+    const [notice, setNotice] = useState('')
+    const detailKey = ['glue-database', accountId, resource?.id]
+
+    const detailQuery = useQuery({
+        queryKey: detailKey,
+        queryFn: ({signal}) => getCloudResource('aws', 'datacatalog', resource?.id ?? '', signal),
+        enabled: Boolean(resource) && runtimeReachable,
+    })
+
+    useEffect(() => {
+        setNotice('')
+        setForm(emptyForm())
+    }, [resource?.id])
+
+    const settle = (updated: CloudResource, message: string) => {
+        queryClient.setQueryData(detailKey, updated)
+        setNotice(message)
+        return queryClient.invalidateQueries({queryKey: cloudQueryKeys.resources('aws', 'datacatalog')})
+    }
+    const createTable = useMutation({
+        mutationFn: () => createCatalogTable('aws', resource?.id ?? '', {
+            name: form.name.trim(),
+            location: form.location.trim(),
+            format: form.format,
+            ...(form.format === 'csv' ? {delimiter: form.delimiter, headerRow: form.headerRow} : {}),
+            columns: form.columns.map((column) => ({name: column.name.trim(), type: column.type})),
+        }),
+        onSuccess: (updated) => {
+            const name = form.name.trim()
+            setForm(emptyForm())
+            return settle(updated, `Created table ${name}. Athena can query it now.`)
+        },
+    })
+    const deleteTable = useMutation({
+        mutationFn: (tableName: string) => deleteCatalogTable('aws', resource?.id ?? '', tableName),
+        onSuccess: (updated, tableName) => settle(updated, `Deleted table ${tableName}. Its files stay in S3.`),
+    })
+
+    if (!resource) {
+        return <section className="table-panel"><div className="empty compact"><h3>Select a database</h3><p>Choose a database to see its tables, or describe files in S3 as a new table.</p></div></section>
+    }
+
+    const database = detailQuery.data ?? resource
+    const tables = Array.isArray(database.metadata.tables) ? database.metadata.tables as CatalogTable[] : []
+    const disabled = !runtimeReachable || createTable.isPending || deleteTable.isPending
+    const error = detailQuery.error ?? createTable.error ?? deleteTable.error
+    const setColumn = (index: number, patch: Partial<Column>) => setForm({...form, columns: form.columns.map((column, i) => i === index ? {...column, ...patch} : column)})
+
+    return <section className="table-panel" style={{marginTop: 16}} aria-label={`Database ${database.name}`}>
+        <div className="input-row resource-table-bar">
+            <div><p className="eyebrow">Glue database</p><span className="muted">{database.metadata.description ? String(database.metadata.description) : 'Tables here describe files in S3 so Athena can query them.'}</span></div>
+            <div className="cdn-actions">
+                <button className="button" type="button" disabled={!runtimeReachable || detailQuery.isFetching} onClick={() => { void detailQuery.refetch() }}><RefreshCw size={14}/>{detailQuery.isFetching ? 'Loading' : 'Refresh'}</button>
+            </div>
+        </div>
+
+        <div className="input-row resource-table-bar"><div><p className="eyebrow">Tables</p><span className="muted">{tables.length === 1 ? '1 table' : `${tables.length} tables`}</span></div></div>
+        {tables.length === 0 ? <p className="muted compact-text catalog-note">No tables yet. Describe a folder of CSV, JSON or Parquet files below.</p>
+            : <div className="cognito-table"><table className="table"><thead><tr><th>Table</th><th>Format</th><th>Location</th><th>Columns</th><th>Updated</th><th aria-label="Actions"/></tr></thead><tbody>{tables.map((table) => (
+                <tr key={table.name}>
+                    <td className="mono">{table.name}{table.description && <><br/><small className="muted">{table.description}</small></>}</td>
+                    <td>{FORMAT_LABELS[table.format] ?? table.format}{table.format === 'csv' && <><br/><small className="muted">{delimiterLabel(table.delimiter)}{table.headerRow ? ', header row' : ''}</small></>}</td>
+                    <td className="mono catalog-location">{table.location ?? '—'}</td>
+                    <td className="catalog-columns">{table.columns.map((column) => <span key={column.name}><code>{column.name}</code> <small className="muted">{column.type}</small></span>)}
+                        {table.partitionKeys.length > 0 && <small className="muted">partitioned by {table.partitionKeys.map((key) => key.name).join(', ')}</small>}</td>
+                    <td>{formatDateTime(table.updatedAt ?? table.createdAt) ?? '—'}</td>
+                    <td className="efs-row-actions"><button className="button compact danger" type="button" disabled={disabled} aria-label={`Delete table ${table.name}`} onClick={() => {
+                        setNotice('')
+                        if (window.confirm(`Delete table ${table.name}? Its files stay in S3.`)) deleteTable.mutate(table.name)
+                    }}>Delete</button></td>
+                </tr>
+            ))}</tbody></table></div>}
+
+        <form className="catalog-form" aria-label="Create table" onSubmit={(event) => { event.preventDefault(); setNotice(''); createTable.mutate() }}>
+            <p className="eyebrow">New table</p>
+            <div className="dynamic-form catalog-form-fields">
+                <label className="dynamic-field"><span>Name</span><input className="input mono" value={form.name} onChange={(event) => setForm({...form, name: event.target.value})} disabled={disabled} required pattern="[a-z_][a-z0-9_]*" title="Lowercase letters, numbers and underscores"/></label>
+                <label className="dynamic-field catalog-span"><span>S3 location</span><input className="input mono" value={form.location} onChange={(event) => setForm({...form, location: event.target.value})} disabled={disabled} required pattern="s3://[a-z0-9.\-]{3,63}(/.*)?" title="A folder such as s3://my-bucket/orders/"/></label>
+                <label className="dynamic-field"><span>Format</span><select className="input" value={form.format} onChange={(event) => setForm({...form, format: event.target.value as TableForm['format']})} disabled={disabled}>
+                    <option value="csv">CSV</option><option value="json">JSON lines</option><option value="parquet">Parquet</option>
+                </select></label>
+                {form.format === 'csv' && <>
+                    <label className="dynamic-field"><span>Delimiter</span><input className="input mono" value={form.delimiter} maxLength={1} onChange={(event) => setForm({...form, delimiter: event.target.value})} disabled={disabled} required/></label>
+                    <label className="dynamic-field catalog-check"><input type="checkbox" checked={form.headerRow} onChange={(event) => setForm({...form, headerRow: event.target.checked})} disabled={disabled}/><span>First line is a header</span></label>
+                </>}
+            </div>
+            <fieldset className="catalog-columns-editor" disabled={disabled}>
+                <legend>Columns</legend>
+                {form.columns.map((column, index) => <div className="catalog-column-row" key={index}>
+                    <input className="input mono" aria-label={`Column ${index + 1} name`} value={column.name} onChange={(event) => setColumn(index, {name: event.target.value})} required pattern="[a-z_][a-z0-9_]*" title="Lowercase letters, numbers and underscores"/>
+                    <select className="input" aria-label={`Column ${index + 1} type`} value={column.type} onChange={(event) => setColumn(index, {type: event.target.value})}>
+                        {COLUMN_TYPES.map((type) => <option key={type} value={type}>{type}</option>)}
+                    </select>
+                    <button className="button compact" type="button" aria-label={`Remove column ${index + 1}`} disabled={form.columns.length === 1} onClick={() => setForm({...form, columns: form.columns.filter((_, i) => i !== index)})}><X size={14}/></button>
+                </div>)}
+                <button className="button compact" type="button" onClick={() => setForm({...form, columns: [...form.columns, {name: '', type: 'string'}]})}><Plus size={14}/>Add column</button>
+            </fieldset>
+            <p className="muted compact-text">List the columns in the order they appear in the files. For JSON, use the field names.</p>
+            <div><button className="button primary" type="submit" disabled={disabled}>{createTable.isPending ? 'Creating' : 'Create table'}</button></div>
+        </form>
+
+        {notice && <p className="cognito-outcome cognito-outcome--ok" role="status">{notice}</p>}
+        {error instanceof Error && <p className="error-text compact-text" role="alert">{error.message}</p>}
+    </section>
+}

packages/frontend/src/components/DynamicResourceView.tsx

@@ -69,6 +69,8 @@ import { CognitoUsersPanel } from "@/components/CognitoUsersPanel";
 import { Route53RecordsPanel } from "@/components/Route53RecordsPanel";
 import { CloudFrontPanel } from "@/components/CloudFrontPanel";
 import { AutoScalingPanel } from "@/components/AutoScalingPanel";
+import { FileSystemPanel } from "@/components/FileSystemPanel";
+import { DataCatalogPanel } from "@/components/DataCatalogPanel";
 import { CertificatePanel } from "@/components/CertificatePanel";
 import { PipePanel } from "@/components/PipePanel";
 import { CloudWatchAlarmPanel } from "@/components/CloudWatchAlarmPanel";
@@ -999,6 +1001,12 @@ export function DynamicResourceView({
       {service === "autoscaling" && cloud === "aws" && (
         <AutoScalingPanel resource={activeSelected} runtimeReachable={canUseRuntime} />
       )}
+      {service === "filesystems" && cloud === "aws" && (
+        <FileSystemPanel resource={activeSelected} runtimeReachable={canUseRuntime} />
+      )}
+      {service === "datacatalog" && cloud === "aws" && (
+        <DataCatalogPanel resource={activeSelected} runtimeReachable={canUseRuntime} />
+      )}
       {service === "cdn" && cloud === "aws" && (
         <CloudFrontPanel resource={activeSelected} runtimeReachable={canUseRuntime} />
       )}

packages/frontend/src/components/FileSystemPanel.test.tsx

@@ -0,0 +1,104 @@
+import {QueryClient, QueryClientProvider} from '@tanstack/react-query'
+import {render, screen, within} from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import {MemoryRouter} from 'react-router-dom'
+import {beforeEach, expect, test, vi} from 'vitest'
+import {FileSystemPanel} from './FileSystemPanel'
+import type {CloudResource} from '@/types/resource'
+
+const api = vi.hoisted(() => ({
+    getCloudResource: vi.fn(),
+    listCloudResources: vi.fn(),
+    createMountTarget: vi.fn(),
+    deleteMountTarget: vi.fn(),
+    createAccessPoint: vi.fn(),
+    deleteAccessPoint: vi.fn(),
+    attachFileSystemToFunction: vi.fn(),
+    detachFileSystemFromFunction: vi.fn(),
+}))
+
+vi.mock('@/api/cloudProxyClient', () => api)
+vi.mock('@/lib/accountStore', () => ({useAccountId: () => '000000000000'}))
+
+function fileSystem(metadata: Record<string, unknown> = {}): CloudResource {
+    return {
+        id: 'fs-1', name: 'shared', cloud: 'aws', service: 'filesystems', type: 'fileSystem', region: 'us-east-1', createdAt: null, status: 'available',
+        metadata: {
+            fileSystemId: 'fs-1', throughputMode: 'bursting', encrypted: true,
+            mountTargets: [{id: 'fsmt-1', subnetId: 'subnet-a', availabilityZone: 'us-east-1a', ipAddress: '10.0.0.10', state: 'available'}],
+            accessPoints: [{id: 'fsap-1', arn: 'arn:aws:elasticfilesystem:us-east-1:000000000000:access-point/fsap-1', name: 'app', path: '/app', uid: 1000, gid: 1000, permissions: '755', state: 'available'}],
+            functions: [{name: 'writer', accessPointId: 'fsap-1', mountPath: '/mnt/share'}],
+            ...metadata,
+        },
+    }
+}
+
+function renderPanel(resource: CloudResource) {
+    api.getCloudResource.mockResolvedValue(resource)
+    const client = new QueryClient({defaultOptions: {queries: {retry: false}}})
+    return render(<MemoryRouter><QueryClientProvider client={client}><FileSystemPanel resource={resource} runtimeReachable/></QueryClientProvider></MemoryRouter>)
+}
+
+beforeEach(() => {
+    vi.clearAllMocks()
+    api.listCloudResources.mockResolvedValue([{id: 'reader', name: 'reader'}, {id: 'writer', name: 'writer'}])
+    for (const fn of [api.createMountTarget, api.deleteMountTarget, api.createAccessPoint, api.deleteAccessPoint, api.attachFileSystemToFunction, api.detachFileSystemFromFunction]) {
+        fn.mockResolvedValue(fileSystem())
+    }
+})
+
+test('shows mount targets, access points and the functions that mount the file system', async () => {
+    renderPanel(fileSystem())
+
+    expect(await screen.findByText('fsmt-1')).toBeInTheDocument()
+    expect(screen.getByText('fsap-1')).toBeInTheDocument()
+    expect(screen.getByRole('link', {name: 'writer'})).toHaveAttribute('href', '/cloud-explorer/aws/serverless')
+    expect(screen.getByText('/mnt/share')).toBeInTheDocument()
+})
+
+test('adds a mount target and creates an access point', async () => {
+    const user = userEvent.setup()
+    renderPanel(fileSystem())
+
+    const mountForm = await screen.findByRole('form', {name: 'Add mount target'})
+    await user.type(within(mountForm).getByLabelText('Subnet ID'), 'subnet-b')
+    await user.click(within(mountForm).getByRole('button', {name: 'Add mount target'}))
+    expect(api.createMountTarget).toHaveBeenCalledWith('aws', 'fs-1', 'subnet-b')
+    expect(await screen.findByText('Added a mount target in subnet-b.')).toBeInTheDocument()
+
+    const accessPointForm = screen.getByRole('form', {name: 'Create access point'})
+    const path = within(accessPointForm).getByLabelText('Root directory')
+    await user.clear(path)
+    await user.type(path, '/uploads')
+    await user.click(within(accessPointForm).getByRole('button', {name: 'Create access point'}))
+    expect(api.createAccessPoint).toHaveBeenCalledWith('aws', 'fs-1', {path: '/uploads', uid: 1000, gid: 1000, permissions: '755'})
+})
+
+test('attaches the file system to a function through an access point', async () => {
+    const user = userEvent.setup()
+    renderPanel(fileSystem())
+
+    const form = await screen.findByRole('form', {name: 'Attach to a function'})
+    await user.selectOptions(within(form).getByLabelText('Function'), await within(form).findByRole('option', {name: 'reader'}))
+    await user.selectOptions(within(form).getByLabelText('Access point'), 'fsap-1')
+    await user.click(within(form).getByRole('button', {name: 'Attach'}))
+
+    expect(api.attachFileSystemToFunction).toHaveBeenCalledWith('aws', 'fs-1', {accessPointId: 'fsap-1', functionName: 'reader', mountPath: '/mnt/data'})
+    expect(await screen.findByText('reader now sees this file system at /mnt/data.')).toBeInTheDocument()
+})
+
+test('detaches a function after confirming', async () => {
+    const user = userEvent.setup()
+    vi.spyOn(window, 'confirm').mockReturnValue(true)
+    renderPanel(fileSystem())
+
+    await user.click(await screen.findByRole('button', {name: 'Detach writer'}))
+    expect(api.detachFileSystemFromFunction).toHaveBeenCalledWith('aws', 'fs-1', 'writer')
+})
+
+test('cannot attach until the file system has a mount target', async () => {
+    renderPanel(fileSystem({mountTargets: [], functions: []}))
+
+    expect(await screen.findByText(/No mount targets yet/)).toBeInTheDocument()
+    expect(within(screen.getByRole('form', {name: 'Attach to a function'})).getByRole('button', {name: 'Attach'})).toBeDisabled()
+})

packages/frontend/src/components/FileSystemPanel.tsx

@@ -0,0 +1,191 @@
+import {RefreshCw} from 'lucide-react'
+import {useMutation, useQuery, useQueryClient} from '@tanstack/react-query'
+import {useEffect, useState} from 'react'
+import {Link} from 'react-router-dom'
+import {
+    attachFileSystemToFunction,
+    createAccessPoint,
+    createMountTarget,
+    deleteAccessPoint,
+    deleteMountTarget,
+    detachFileSystemFromFunction,
+    getCloudResource,
+    listCloudResources,
+} from '@/api/cloudProxyClient'
+import {cloudQueryKeys} from '@/api/queries/cloudQueries'
+import {useAccountId} from '@/lib/accountStore'
+import type {CloudResource} from '@/types/resource'
+
+type Props = {
+    resource?: CloudResource
+    runtimeReachable: boolean
+}
+
+type MountTarget = {id: string; subnetId: string | null; availabilityZone: string | null; ipAddress: string | null; state: string | null}
+type AccessPoint = {id: string; arn: string | null; name: string | null; path: string; uid: number | null; gid: number | null; permissions: string | null; state: string | null}
+type MountedFunction = {name: string; accessPointId: string | null; mountPath: string | null}
+
+const EMPTY_ACCESS_POINT = {name: '', path: '/', uid: '1000', gid: '1000', permissions: '755'}
+
+export function FileSystemPanel({resource, runtimeReachable}: Props) {
+    const accountId = useAccountId()
+    const queryClient = useQueryClient()
+    const [subnetId, setSubnetId] = useState('')
+    const [accessPointForm, setAccessPointForm] = useState(EMPTY_ACCESS_POINT)
+    const [attachForm, setAttachForm] = useState({accessPointId: '', functionName: '', mountPath: '/mnt/data'})
+    const [notice, setNotice] = useState('')
+    const detailKey = ['efs-file-system', accountId, resource?.id]
+
+    const detailQuery = useQuery({
+        queryKey: detailKey,
+        queryFn: ({signal}) => getCloudResource('aws', 'filesystems', resource?.id ?? '', signal),
+        enabled: Boolean(resource) && runtimeReachable,
+    })
+    const functionsQuery = useQuery({
+        queryKey: cloudQueryKeys.resources('aws', 'serverless'),
+        queryFn: ({signal}) => listCloudResources('aws', 'serverless', undefined, signal),
+        enabled: Boolean(resource) && runtimeReachable,
+    })
+
+    useEffect(() => {
+        setNotice('')
+        setSubnetId('')
+        setAccessPointForm(EMPTY_ACCESS_POINT)
+        setAttachForm({accessPointId: '', functionName: '', mountPath: '/mnt/data'})
+    }, [resource?.id])
+
+    const settle = (updated: CloudResource, message: string) => {
+        queryClient.setQueryData(detailKey, updated)
+        setNotice(message)
+        return queryClient.invalidateQueries({queryKey: cloudQueryKeys.resources('aws', 'filesystems')})
+    }
+    const id = resource?.id ?? ''
+    const addMountTarget = useMutation({
+        mutationFn: () => createMountTarget('aws', id, subnetId.trim()),
+        onSuccess: (updated) => { setSubnetId(''); return settle(updated, `Added a mount target in ${subnetId.trim()}.`) },
+    })
+    const removeMountTarget = useMutation({
+        mutationFn: (mountTargetId: string) => deleteMountTarget('aws', id, mountTargetId),
+        onSuccess: (updated, mountTargetId) => settle(updated, `Removed mount target ${mountTargetId}.`),
+    })
+    const addAccessPoint = useMutation({
+        mutationFn: () => createAccessPoint('aws', id, {
+            ...(accessPointForm.name.trim() ? {name: accessPointForm.name.trim()} : {}),
+            path: accessPointForm.path.trim(),
+            uid: Number(accessPointForm.uid),
+            gid: Number(accessPointForm.gid),
+            permissions: accessPointForm.permissions.trim(),
+        }),
+        onSuccess: (updated) => { setAccessPointForm(EMPTY_ACCESS_POINT); return settle(updated, `Created an access point at ${accessPointForm.path.trim()}.`) },
+    })
+    const removeAccessPoint = useMutation({
+        mutationFn: (accessPointId: string) => deleteAccessPoint('aws', id, accessPointId),
+        onSuccess: (updated, accessPointId) => settle(updated, `Deleted access point ${accessPointId}.`),
+    })
+    const attach = useMutation({
+        mutationFn: () => attachFileSystemToFunction('aws', id, {...attachForm, mountPath: attachForm.mountPath.trim()}),
+        onSuccess: (updated) => settle(updated, `${attachForm.functionName} now sees this file system at ${attachForm.mountPath.trim()}.`),
+    })
+    const detach = useMutation({
+        mutationFn: (functionName: string) => detachFileSystemFromFunction('aws', id, functionName),
+        onSuccess: (updated, functionName) => settle(updated, `Detached ${functionName}.`),
+    })
+
+    if (!resource) {
+        return <section className="table-panel"><div className="empty compact"><h3>Select a file system</h3><p>Choose a file system to manage its mount targets and access points, and attach it to Lambda functions.</p></div></section>
+    }
+
+    const fileSystem = detailQuery.data ?? resource
+    const metadata = fileSystem.metadata
+    const mountTargets = Array.isArray(metadata.mountTargets) ? metadata.mountTargets as MountTarget[] : []
+    const accessPoints = Array.isArray(metadata.accessPoints) ? metadata.accessPoints as AccessPoint[] : []
+    const mounted = Array.isArray(metadata.functions) ? metadata.functions as MountedFunction[] : []
+    const functionNames = (functionsQuery.data ?? []).map((fn) => fn.name).sort()
+    const mutations = [addMountTarget, removeMountTarget, addAccessPoint, removeAccessPoint, attach, detach]
+    const disabled = !runtimeReachable || mutations.some((mutation) => mutation.isPending)
+    const error = detailQuery.error ?? mutations.find((mutation) => mutation.error)?.error
+    const accessPointLabel = (accessPointId: string | null) => {
+        const accessPoint = accessPoints.find((candidate) => candidate.id === accessPointId)
+        return accessPoint ? `${accessPoint.name ?? accessPoint.id} (${accessPoint.path})` : accessPointId ?? '—'
+    }
+    const run = (action: () => void) => { setNotice(''); action() }
+
+    return <section className="table-panel" style={{marginTop: 16}} aria-label={`File system ${fileSystem.name}`}>
+        <div className="input-row resource-table-bar">
+            <div><p className="eyebrow">EFS file system</p><span className="muted mono">{String(metadata.fileSystemId ?? fileSystem.id)}</span><span className="muted"> · {String(metadata.throughputMode ?? '')} · {metadata.encrypted ? 'encrypted' : 'not encrypted'}</span></div>
+            <div className="cdn-actions">
+                <button className="button" type="button" disabled={!runtimeReachable || detailQuery.isFetching} onClick={() => { void detailQuery.refetch() }}><RefreshCw size={14}/>{detailQuery.isFetching ? 'Loading' : 'Refresh'}</button>
+            </div>
+        </div>
+
+        <div className="input-row resource-table-bar"><div><p className="eyebrow">Mount targets</p><span className="muted">Functions and tasks reach the file system through a mount target in their subnet.</span></div></div>
+        {mountTargets.length === 0 ? <p className="muted compact-text efs-note">No mount targets yet. Add one before attaching the file system to a function.</p>
+            : <div className="cognito-table"><table className="table"><thead><tr><th>Mount target</th><th>Subnet</th><th>Zone</th><th>IP address</th><th>State</th><th aria-label="Actions"/></tr></thead><tbody>{mountTargets.map((mountTarget) => (
+                <tr key={mountTarget.id}>
+                    <td className="mono">{mountTarget.id}</td>
+                    <td className="mono">{mountTarget.subnetId ?? '—'}</td>
+                    <td>{mountTarget.availabilityZone ?? '—'}</td>
+                    <td className="mono">{mountTarget.ipAddress ?? '—'}</td>
+                    <td><code>{mountTarget.state ?? '—'}</code></td>
+                    <td className="efs-row-actions"><button className="button compact danger" type="button" disabled={disabled} aria-label={`Remove ${mountTarget.id}`} onClick={() => run(() => {
+                        if (window.confirm(`Remove mount target ${mountTarget.id}?`)) removeMountTarget.mutate(mountTarget.id)
+                    })}>Remove</button></td>
+                </tr>
+            ))}</tbody></table></div>}
+        <form className="dynamic-form efs-inline-form" aria-label="Add mount target" onSubmit={(event) => { event.preventDefault(); run(() => addMountTarget.mutate()) }}>
+            <label className="dynamic-field"><span>Subnet ID</span><input className="input mono" value={subnetId} placeholder="subnet-…" onChange={(event) => setSubnetId(event.target.value)} disabled={disabled} required/></label>
+            <div><button className="button" type="submit" disabled={disabled || !subnetId.trim()}>{addMountTarget.isPending ? 'Adding' : 'Add mount target'}</button></div>
+        </form>
+
+        <div className="input-row resource-table-bar"><div><p className="eyebrow">Access points</p><span className="muted">An entry point into one directory, as a fixed POSIX user. Lambda mounts a file system through an access point.</span></div></div>
+        {accessPoints.length === 0 ? <p className="muted compact-text efs-note">No access points yet.</p>
+            : <div className="cognito-table"><table className="table"><thead><tr><th>Access point</th><th>Root directory</th><th>POSIX user</th><th>State</th><th aria-label="Actions"/></tr></thead><tbody>{accessPoints.map((accessPoint) => (
+                <tr key={accessPoint.id}>
+                    <td>{accessPoint.name && <>{accessPoint.name}<br/></>}<small className="mono">{accessPoint.id}</small></td>
+                    <td className="mono">{accessPoint.path}{accessPoint.permissions ? <small className="muted"> ({accessPoint.permissions})</small> : null}</td>
+                    <td className="mono">{accessPoint.uid ?? '—'}:{accessPoint.gid ?? '—'}</td>
+                    <td><code>{accessPoint.state ?? '—'}</code></td>
+                    <td className="efs-row-actions"><button className="button compact danger" type="button" disabled={disabled} aria-label={`Delete ${accessPoint.id}`} onClick={() => run(() => {
+                        if (window.confirm(`Delete access point ${accessPoint.id}? Files stay in the file system.`)) removeAccessPoint.mutate(accessPoint.id)
+                    })}>Delete</button></td>
+                </tr>
+            ))}</tbody></table></div>}
+        <form className="dynamic-form efs-access-point-form" aria-label="Create access point" onSubmit={(event) => { event.preventDefault(); run(() => addAccessPoint.mutate()) }}>
+            <label className="dynamic-field"><span>Name</span><input className="input" value={accessPointForm.name} onChange={(event) => setAccessPointForm({...accessPointForm, name: event.target.value})} disabled={disabled}/></label>
+            <label className="dynamic-field"><span>Root directory</span><input className="input mono" value={accessPointForm.path} onChange={(event) => setAccessPointForm({...accessPointForm, path: event.target.value})} disabled={disabled} required pattern="/.*" title="Start with /"/></label>
+            <label className="dynamic-field"><span>User ID</span><input className="input" type="number" min={0} value={accessPointForm.uid} onChange={(event) => setAccessPointForm({...accessPointForm, uid: event.target.value})} disabled={disabled} required/></label>
+            <label className="dynamic-field"><span>Group ID</span><input className="input" type="number" min={0} value={accessPointForm.gid} onChange={(event) => setAccessPointForm({...accessPointForm, gid: event.target.value})} disabled={disabled} required/></label>
+            <label className="dynamic-field"><span>Permissions</span><input className="input mono" value={accessPointForm.permissions} onChange={(event) => setAccessPointForm({...accessPointForm, permissions: event.target.value})} disabled={disabled} required pattern="[0-7]{3,4}" title="Octal, such as 755"/></label>
+            <div><button className="button" type="submit" disabled={disabled}>{addAccessPoint.isPending ? 'Creating' : 'Create access point'}</button></div>
+        </form>
+
+        <div className="input-row resource-table-bar"><div><p className="eyebrow">Lambda functions</p><span className="muted">Functions that mount this file system share its files. A function can mount one file system.</span></div></div>
+        {mounted.length === 0 ? <p className="muted compact-text efs-note">No function mounts this file system.</p>
+            : <div className="cognito-table"><table className="table"><thead><tr><th>Function</th><th>Mount path</th><th>Access point</th><th aria-label="Actions"/></tr></thead><tbody>{mounted.map((fn) => (
+                <tr key={fn.name}>
+                    <td><Link to="/cloud-explorer/aws/serverless" className="mono">{fn.name}</Link></td>
+                    <td className="mono">{fn.mountPath ?? '—'}</td>
+                    <td>{accessPointLabel(fn.accessPointId)}</td>
+                    <td className="efs-row-actions"><button className="button compact danger" type="button" disabled={disabled} aria-label={`Detach ${fn.name}`} onClick={() => run(() => {
+                        if (window.confirm(`Detach the file system from ${fn.name}?`)) detach.mutate(fn.name)
+                    })}>Detach</button></td>
+                </tr>
+            ))}</tbody></table></div>}
+        {accessPoints.length > 0 && <form className="dynamic-form efs-access-point-form" aria-label="Attach to a function" onSubmit={(event) => { event.preventDefault(); run(() => attach.mutate()) }}>
+            <label className="dynamic-field"><span>Function</span><select className="input" value={attachForm.functionName} onChange={(event) => setAttachForm({...attachForm, functionName: event.target.value})} disabled={disabled} required>
+                <option value="">{functionNames.length === 0 ? 'No functions yet' : 'Choose a function'}</option>
+                {functionNames.map((name) => <option key={name} value={name}>{name}</option>)}
+            </select></label>
+            <label className="dynamic-field"><span>Access point</span><select className="input" value={attachForm.accessPointId} onChange={(event) => setAttachForm({...attachForm, accessPointId: event.target.value})} disabled={disabled} required>
+                <option value="">Choose an access point</option>
+                {accessPoints.map((accessPoint) => <option key={accessPoint.id} value={accessPoint.id}>{accessPointLabel(accessPoint.id)}</option>)}
+            </select></label>
+            <label className="dynamic-field"><span>Mount path</span><input className="input mono" value={attachForm.mountPath} onChange={(event) => setAttachForm({...attachForm, mountPath: event.target.value})} disabled={disabled} required pattern="/mnt/[a-zA-Z0-9\-_.]+" title="Under /mnt, such as /mnt/data"/></label>
+            <div><button className="button" type="submit" disabled={disabled || mountTargets.length === 0} title={mountTargets.length === 0 ? 'Add a mount target first' : undefined}>{attach.isPending ? 'Attaching' : 'Attach'}</button></div>
+        </form>}
+        {accessPoints.length > 0 && <p className="muted compact-text efs-note">Lambda needs a VPC to mount a file system. A function not yet in one is put in this file system&apos;s mount target subnets with the default security group.</p>}
+
+        {notice && <p className="cognito-outcome cognito-outcome--ok" role="status">{notice}</p>}
+        {error instanceof Error && <p className="error-text compact-text" role="alert">{error.message}</p>}
+    </section>
+}

packages/frontend/src/components/serviceIcons.tsx

@@ -7,6 +7,7 @@ import {
     Database,
     Earth,
     FileBadge,
+    FolderTree,
     Globe,
     HardDrive,
     Hammer,
@@ -39,6 +40,8 @@ import cognitoIcon from '../../../../aws-icons-svg/Security-Identity-Compliance/
 import route53Icon from '../../../../aws-icons-svg/Networking-Content-Delivery/Route-53.svg'
 import cloudFrontIcon from '../../../../aws-icons-svg/Networking-Content-Delivery/CloudFront.svg'
 import autoScalingIcon from '../../../../aws-icons-svg/Compute/EC2-Auto-Scaling.svg'
+import efsIcon from '../../../../aws-icons-svg/Storage/EFS.svg'
+import glueIcon from '../../../../aws-icons-svg/Analytics/Glue.svg'
 import certificateManagerIcon from '../../../../aws-icons-svg/Security-Identity-Compliance/Certificate-Manager.svg'
 import cloudWatchIcon from '../../../../aws-icons-svg/Management-Governance/CloudWatch.svg'
 import cloudFormationIcon from '@/assets/aws-services/cloudformation.svg'
@@ -101,6 +104,8 @@ const SERVICE_ICONS: Record<string, LucideIcon> = {
     dns: Globe,
     cdn: Earth,
     autoscaling: Scaling,
+    filesystems: FolderTree,
+    datacatalog: Table2,
     certificates: FileBadge,
     monitoring: Activity,
     loadbalancing: Scale,
@@ -151,6 +156,8 @@ const AWS_SERVICE_ICON_ASSETS: Record<string, string> = {
     dns: route53Icon,
     cdn: cloudFrontIcon,
     autoscaling: autoScalingIcon,
+    filesystems: efsIcon,
+    datacatalog: glueIcon,
     certificates: certificateManagerIcon,
     monitoring: cloudWatchIcon,
     workflows: stepFunctionsIcon,

packages/frontend/src/index.css

@@ -6630,3 +6630,27 @@ tr[aria-current="true"] td { background: var(--hover-md); }
 .autoscaling-capacity { grid-template-columns: repeat(auto-fit, minmax(110px, 1fr)); align-items: end; padding: 4px 16px 12px; }
 .autoscaling-note { padding: 0 16px 12px; margin: 0; }
 .autoscaling-instance-actions { display: flex; flex-wrap: wrap; gap: 6px; justify-content: flex-end; }
+
+/* EFS: short inline forms under each table, row actions on the right. */
+.efs-note { padding: 0 16px 12px; margin: 0; }
+.efs-inline-form { grid-template-columns: minmax(180px, 320px) auto; align-items: end; padding: 4px 16px 12px; }
+.efs-access-point-form { grid-template-columns: repeat(auto-fit, minmax(130px, 1fr)); align-items: end; padding: 4px 16px 12px; }
+.efs-row-actions { text-align: right; }
+
+/* Glue Data Catalog: column chips in the tables list, a compact column editor. */
+.catalog-note { padding: 0 16px 12px; margin: 0; }
+.catalog-location { overflow-wrap: anywhere; }
+.catalog-columns { display: flex; flex-wrap: wrap; gap: 4px 10px; }
+.catalog-columns > small { flex-basis: 100%; }
+.catalog-form { display: grid; gap: 10px; padding: 12px 16px; border-top: 1px solid var(--border); }
+.catalog-form p { margin: 0; }
+.catalog-form-fields { grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); align-items: end; }
+.catalog-span { grid-column: span 2; }
+.catalog-check { display: flex; align-items: center; gap: 8px; min-height: 30px; }
+.catalog-check input { width: auto; }
+.catalog-columns-editor { display: grid; gap: 6px; border: 0; padding: 0; margin: 0; min-width: 0; }
+.catalog-columns-editor legend { color: var(--text-2); font-size: 11px; font-weight: 600; text-transform: uppercase; margin-bottom: 4px; }
+.catalog-column-row { display: grid; grid-template-columns: minmax(0, 2fr) minmax(0, 1fr) auto; gap: 6px; max-width: 560px; }
+.catalog-column-row .input { width: 100%; min-width: 0; }
+.catalog-columns-editor > .button { justify-self: start; }
+@media (max-width: 640px) { .catalog-span { grid-column: auto; } }

packages/frontend/src/types/resource.ts

@@ -362,6 +362,35 @@ export interface AutoScalingCapacityInput {
     maxSize?: number
 }
 
+export interface CatalogColumnInput {
+    name: string
+    type: string
+}
+
+export interface CatalogTableInput {
+    name: string
+    description?: string
+    location: string
+    format: 'csv' | 'json' | 'parquet'
+    delimiter?: string
+    headerRow?: boolean
+    columns: CatalogColumnInput[]
+}
+
+export interface AccessPointInput {
+    name?: string
+    path: string
+    uid: number
+    gid: number
+    permissions: string
+}
+
+export interface FileSystemAttachmentInput {
+    accessPointId: string
+    functionName: string
+    mountPath: string
+}
+
 export interface DistributionInvalidation {
     id: string
     status: string

packages/frontend/src/types/schema.ts

@@ -30,6 +30,8 @@ export type ItemActionName = 'list' | 'get' | 'put' | 'delete' | 'query'
 export type DistributionActionName = 'setEnabled' | 'createInvalidation'
 export type AutoScalingActionName = 'setCapacity' | 'terminateInstance'
 export type CertificateActionName = 'download' | 'export' | 'revoke'
+export type DataCatalogActionName = 'createTable' | 'deleteTable'
+export type FileSystemActionName = 'createMountTarget' | 'deleteMountTarget' | 'createAccessPoint' | 'deleteAccessPoint' | 'attachFunction' | 'detachFunction'
 export type MonitoringActionName = 'listMetrics' | 'getMetricData' | 'alarmHistory' | 'setAlarmState' | 'setAlarmActions'
 export type UserPoolActionName = 'updateUser' | 'setUserGroups' | 'listGroups' | 'createGroup' | 'deleteGroup' | 'testSignIn' | 'describeClient' | 'updateClientOAuth'
 export type CapabilityStatus = 'available' | 'blocked' | 'partial' | 'coming_soon'
@@ -95,6 +97,8 @@ export interface ServiceSchema {
         distributionActions?: Array<CapabilitySchema<DistributionActionName>>
         autoScalingActions?: Array<CapabilitySchema<AutoScalingActionName>>
         certificateActions?: Array<CapabilitySchema<CertificateActionName>>
+        fileSystemActions?: Array<CapabilitySchema<FileSystemActionName>>
+        dataCatalogActions?: Array<CapabilitySchema<DataCatalogActionName>>
         monitoringActions?: Array<CapabilitySchema<MonitoringActionName>>
     }
     filters: FieldSchema[]

pnpm-lock.yaml

@@ -61,6 +61,9 @@ importers:
       '@aws-sdk/client-ecs':
         specifier: ^3.1076.0
         version: 3.1145.0
+      '@aws-sdk/client-efs':
+        specifier: ^3.1146.0
+        version: 3.1146.0
       '@aws-sdk/client-eks':
         specifier: ^3.1076.0
         version: 3.1076.0
@@ -73,6 +76,9 @@ importers:
       '@aws-sdk/client-eventbridge':
         specifier: ^3.1076.0
         version: 3.1121.0
+      '@aws-sdk/client-glue':
+        specifier: ^3.1146.0
+        version: 3.1156.0
       '@aws-sdk/client-iam':
         specifier: ^3.1076.0
         version: 3.1120.0
@@ -375,6 +381,10 @@ packages:
     resolution: {integrity: sha512-r3Kfyv+ax47DcXUKgMV/n9xUhKL1KjDBo3HC6+4CL+lOWXXYXsEJIWpQrDZYVwX8nbxuD7TXVFfEeY/38dmD1Q==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/client-efs@3.1146.0':
+    resolution: {integrity: sha512-hu8iQM3KlhUn7zAS5iZEi0Vf6R/NaCPZXiQdqcVZYBwABnqUM4aTgdZmnhVM1I1+hpE/xWZ+HAfOs/aygGYifw==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/client-eks@3.1076.0':
     resolution: {integrity: sha512-Hqr3hdwUgqWAQbdx6UDy81UBF+jdu3ws6RrykQ4YmBhe/XOKv57lt2lhkjgBuF9fiSw4UUl2XQteks9oxgm4XA==}
     engines: {node: '>=20.0.0'}
@@ -391,6 +401,10 @@ packages:
     resolution: {integrity: sha512-+zT6z91ZxHozsKGWf5wOJfxEebht3GmPBoXedlWoumHeAvzAueM1KwbWkzClLWjpi76HXuCIx7R3x4pvSVGqIw==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/client-glue@3.1156.0':
+    resolution: {integrity: sha512-IkH03UtDnHWpbcdN11bWOr4XeS7F13veZ3/1ukRPznRwtrtXBVC3SivkQVJEeQ18stsKqgX3xMOK8UZH9imiiQ==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/client-iam@3.1120.0':
     resolution: {integrity: sha512-w1UNruAHPJ2l6+fNsW3wBYa725ALR1FRQe+rLheeziNK3EmGK6wxTm39dgKyehPmeSXxEQYCg5gcrYq3Ew3CzQ==}
     engines: {node: '>=20.0.0'}
@@ -3113,6 +3127,17 @@ snapshots:
       '@smithy/types': 4.19.0
       tslib: 2.8.1
 
+  '@aws-sdk/client-efs@3.1146.0':
+    dependencies:
+      '@aws-sdk/core': 3.978.5
+      '@aws-sdk/credential-provider-node': 3.972.88
+      '@aws-sdk/types': 3.975.0
+      '@smithy/core': 3.36.2
+      '@smithy/fetch-http-handler': 5.8.0
+      '@smithy/node-http-handler': 4.12.1
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
   '@aws-sdk/client-eks@3.1076.0':
     dependencies:
       '@aws-crypto/sha256-browser': 5.2.0
@@ -3160,6 +3185,17 @@ snapshots:
       '@smithy/types': 4.17.2
       tslib: 2.8.1
 
+  '@aws-sdk/client-glue@3.1156.0':
+    dependencies:
+      '@aws-sdk/core': 3.978.5
+      '@aws-sdk/credential-provider-node': 3.972.88
+      '@aws-sdk/types': 3.975.0
+      '@smithy/core': 3.36.2
+      '@smithy/fetch-http-handler': 5.8.0
+      '@smithy/node-http-handler': 4.12.1
+      '@smithy/types': 4.19.0
+      tslib: 2.8.1
+
   '@aws-sdk/client-iam@3.1120.0':
     dependencies:
       '@aws-sdk/core': 3.977.9