Deploy your own copy

AWS access key ID AWS secret access key AWS region Budget alert email (optional)

Creates a monthly AWS budget (default $10 for the whole account; change the BUDGET_AMOUNT repository variable) that emails you at 80% of actual and 100% of forecast spend, so a traffic spike or a leaked key shows up before the invoice does. Needs budgets:ModifyBudget on the IAM user. Leave empty to skip.

Use a dedicated IAM user limited to S3, CloudFront and IAM-policy-document actions. The keys are encrypted in your browser with the new repository's public key and stored as that repository's Actions secrets; they go nowhere else.

Service-account key (JSON) Google Cloud project id Bucket location Billing account id for a budget alert (optional)

Creates a monthly budget on this project (default 10 in your billing currency; change the BUDGET_AMOUNT repository variable) that emails the billing account's admins at 80% of actual and 100% of forecast spend. Needs the Billing Account Costs Manager role for the service account and the Cloud Billing Budget API enabled. Leave empty to skip.

Create a dedicated service account with only Storage Admin on your project and download a JSON key. The key is encrypted in your browser with the new repository's public key and stored as that repository's Actions secret; it goes nowhere else. Delete the key when you are done if you will not redeploy. The bucket is public by design (it is a website); if your organization blocks public buckets, pick another provider.

Service principal application (client) ID Service principal client secret Directory (tenant) ID Subscription ID Azure region Budget alert email (optional)

Creates a monthly budget on the site's resource group (default 10 in your billing currency; change the BUDGET_AMOUNT repository variable) that emails you at 80% of actual and 100% of forecast spend. Leave empty to skip.

Create a dedicated service principal with the Contributor role on your subscription (az ad sp create-for-rbac --role Contributor --scopes /subscriptions/<id>). The values are encrypted in your browser with the new repository's public key and stored as that repository's Actions secrets; they go nowhere else. Delete the principal when you are done if you will not redeploy.

Cloudflare API token Cloudflare account id

Create a token at My Profile -> API Tokens from the “Edit Cloudflare Workers” template, or a custom token with only Account -> Cloudflare Pages -> Edit. Your account id is on the right of the dashboard’s Workers & Pages page. Both are encrypted in your browser with the new repository’s public key and stored as that repository’s Actions secrets; they go nowhere else. Delete the token when you are done if you will not redeploy.