Prod → Dev Sync

Refreshes the shared dev environment from an anonymized production snapshot, preserving Aerscape dev logins.

• Script: aws_control/prod-to-dev-sync/prod-to-dev-sync.sh
• Target: app-cluster-dev in us-east-1
• Trigger: GitHub Actions → Prod-to-Dev-Sync → Run workflow (manual)

See Environment Syncs for the shared pipeline; this page covers what is specific to dev.

---

What it does

A single linear bash script that runs the shared pipeline: backup → download prod snapshot → restore to staging → anonymize → stop services → extract dev users → replace dev DB → re-insert dev users → migrate → start services → sync S3.

The staging database is prod_staging_anonymized (configurable via STAGING_DB); the target dev database defaults to postgres (DEV_DB).

Dev user preservation

Dev users are identified by email:

email LIKE '%@aerscape.com' AND email NOT LIKE '%+%@aerscape.com'

i.e. real @aerscape.com logins, excluding +-tagged test addresses (those come back anonymized from prod instead). prepare_dev_seed.sql extracts these users — plus their companies, SSO configs, and memberships — into /tmp/dev_seed.sql before the swap, then the script replays it afterward. All IDs are regenerated by sequences to avoid collisions with prod IDs in the restored data.

S3 media sync

aws s3 sync --delete \
  s3://aerscape-prod-backup-ohio s3://"$AWS_STORAGE_BUCKET_NAME" \
  --source-region us-east-2 --region us-east-1 \
  --exclude 'data_import/*'

Runs twice in the script's logic: once inside the COPY_ONLY fast-path, once as the final step of a full sync. See the planned exclusions change.

Environment variables

Dev (target) side

Variable	Notes
DB_URL	Hostname of the dev PostgreSQL server
PGPASSWORD	Dev DB password
RESTIC_PASSWORD	Password for the dev restic repo (backup step)
AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY	Dev AWS creds (ECS, S3)
AWS_STORAGE_BUCKET_NAME	Dev media bucket

Prod (source) side

Variable	Notes
PROD_RESTIC_PASSWORD	Prod restic repo password
PROD_AWS_ACCESS_KEY_ID / PROD_AWS_SECRET_ACCESS_KEY	Read prod backup repo
SOURCE_RESTIC_REPOSITORY	Defaults to s3:https://s3.us-west-1.amazonaws.com/aerscape-db-backups

Common / optional

Variable	Default	Notes
STAGING_DB	prod_staging_anonymized	Staging DB name
DEV_DB	postgres	Target DB name
PGUSER / PGPORT	postgres / 5432
SKIP_SLACK	false	Suppress Slack notifications
COPY_ONLY	false	Run only the S3 media sync
PROD_DUMP_FILE	prod_postgres.gz	Expected dump filename in the snapshot

The prod-to-dev README.md in aws_control has drifted from the script (it references DEV_DB_URL, aerscape_anon_staging, etc.). The table above reflects the actual variables the current script reads.

Known issues

• Sensor API keys — anonymize_db.sql writes plaintext into Fernet-encrypted columns, so Django raises a cryptography error when reading those sensor rows. Known limitation.
• Staging DB is not dropped — the cleanup step (drop prod_staging_anonymized) is commented out, so the anonymized staging DB persists on the dev server between runs.