Live checklist (AWSUTOPIA_LIVE=1)

Not run in CI. Manual only against a disposable sandbox account or LocalStack.

1. export AWS_PROFILE=sandbox
2. awsutopia login --profile sandbox (if SSO)
3. awsutopia init live-check --env dev
4. awsutopia create bucket <unique-name>
5. awsutopia list — tagged; cost COST_UNAVAILABLE
6. awsutopia create secret demo-key --value 'temporary' then secret get (redacted) / --reveal
7. Optional: awsutopia create fn hello --src ./fn then awsutopia logs hello --since 1h
8. Optional: awsutopia create site www --src ./dist then open the printed CloudFront URL
9. Optional: awsutopia create server web --image ubuntu-24 --size small then connect web --dry-run (live connect needs SSM Online)
10. Optional: awsutopia create db postgres app --size small then db connect app --via web --dry-run (password never printed)
11. Optional: awsutopia create kv sessions 11b. Optional: awsutopia create queue jobs12. Upload an object, then awsutopia bucket share <bucket> <key> --expires 30m
12. awsutopia destroy kv sessions --yes (if created)
13. awsutopia destroy db app --keep-data --yes (if created)
14. awsutopia destroy server web --yes (if created)
15. awsutopia destroy site www --yes (if created)
16. awsutopia destroy fn hello --yes (if created)
17. awsutopia destroy secret demo-key --yes
18. awsutopia destroy bucket <name> --yes
19. awsutopia list — empty for this project

Keep AWSUTOPIA_LIVE unset in GitHub Actions. Default tests never call real AWS.