Deployment Guide

Permissions
- Use GitHub OIDC or AWS keys with least-privilege policies allowing: s3:*, dynamodb:*, budgets:*, sns:*, sts:GetCallerIdentity. Narrow to resource ARNs created by this repo where possible.

Workflows
- deploy.yml: manual; prints cost estimate and creates resources when confirm_deploy=true
- destroy.yml: manual; requires input confirm="I want to destroy"
- run-crawl.yml: manual; runs a single crawl job

IAM Review
- The deploy script prints created resources; review in AWS console and adjust policies as needed.


