nvm, just learned about this https://docs.datomic.com/on-prem/excision.html

No excision in Cloud (yet) but here’s a good description of what’s required https://vvvvalvalval.github.io/posts/2018-05-01-making-a-datomic-system-gdpr-compliant.html

you can store the keys as encrypted SSM params and read them using ion/get-params. just make sure they start with “datomic-shared” or they won’t be accessible without extra IAM perms (this caught me out)

https://github.com/magnetcoop/secret-storage.aws-ssm-ps

AWS System Manager Parameter

https://medium.com/magnetcoop/gdpr-right-to-be-forgotten-vs-datomic-3d0413caf102

I thought it was required to connect to the bastion host

The startup script of the bastion generates a keypair and uploads the public key to s3 which the proxy script downloads. So the ec2 keyname is actually not used.

there are ssh keys used for the Datomic nodes themselves -- I think that's what it's for

they're distinct from the bastion key