Delivery & teardown

How StrataBI modules — and the StrataBI platform itself — are packaged, delivered into your AWS account, and removed. This is the lifecycle behind StrataCTL's install, update, and uninstall.

Signed bundles

Every module and platform edition is delivered as a single signed bundle (a module.zip): the OpenTofu that provisions it, a manifest, and default variables. When you install, the ephemeral runner in your account downloads the bundle, verifies its checksum and signature, unpacks it, and runs OpenTofu against your own S3 state backend.

The Terraform travels inside the bundle — nothing is pulled from an external source tree at deploy time, and your account owns the state and logs end to end.

Delivery modes

Each module declares a delivery mode that controls whether its Terraform is persisted into your environment after a successful install:

Mode	Terraform kept in your account?	Teardown source	Works offline / airgapped
`local` (default)	Yes — the verified bundle is cached to your own bucket	The cached bundle, re-verified	Yes
`managed`	No — nothing is left behind	Re-fetched at teardown time	No (needs connectivity)

local is the default. The bundle's Terraform ends up in your account, so

updates and teardown work with no contact to Shaleio — including in fully disconnected environments. The StrataBI platform is always local.

managed leaves zero footprint; teardown re-fetches the bundle. Use it for

add-on modules where you'd rather keep nothing behind.

Your install registry records the mode and the bundle's location, so uninstall always knows exactly where to find the Terraform to run destroy.

Teardown is always available

Note

You can always tear down what you installed. Even if a subscription has lapsed or a module version has been retired, stratactl uninstall will cleanly remove the deployment. Shaleio retains every published bundle, so the Terraform needed to run destroy is always fetchable, and your Terraform state lives in your account throughout. A lapsed or retired entitlement blocks new installs and updates — it never blocks teardown.

Airgapped and disconnected installs

For environments with no outbound access to Shaleio, use local delivery and install from your own bucket:

Obtain the signed bundle (and, for the platform, the runtime wheel and the

Shaleio signing public key) from Shaleio through your normal secure channel.

Place the bundle in an S3 bucket in your account.
Install from it:

bash

stratactl install <module> --source customer_s3

The runner verifies the bundle's signature offline against the Shaleio public key before it runs anything — no call to Shaleio is made. Because delivery is local, later update and uninstall also run entirely offline from the persisted bundle.

Commands

bash

stratactl install <module>      # deploy (verifies + runs OpenTofu in your account)
stratactl update  <module>      # apply a new version
stratactl uninstall <module>    # run the module's destroy (always available)
stratactl list                  # what's installed, and its delivery mode

See StrataCTL for the full command surface and configuration.