Skip to content

feat: qualify BYO cloud access and remote bindings - #376

Draft
alongubkin wants to merge 20 commits into
alon/alien-476-ai-usage-observerfrom
alon/alien-476-fix-byo-cloudformation-permissions
Draft

feat: qualify BYO cloud access and remote bindings#376
alongubkin wants to merge 20 commits into
alon/alien-476-ai-usage-observerfrom
alon/alien-476-fix-byo-cloudformation-permissions

Conversation

@alongubkin

Copy link
Copy Markdown
Member

Summary

  • grant the generated AWS Management identity Bedrock model-availability access
  • grant the generated AWS Management identity only kms:DescribeKey for Enterprise Key observation
  • keep inference and cryptographic operations on the separate Access identity
  • validate the resulting role split in rendered CloudFormation resources

Verification

  • cargo test -p alien-cloudformation aws_remote_ai_permissions_attach_to_access_role
  • cargo test -p alien-cloudformation aws_key_template_is_valid_and_retained

Stack

Stacked on #375. Draft until real alien-test-target CloudFormation qualification completes.

@alongubkin alongubkin changed the title fix: grant BYO management observation access feat: qualify BYO cloud access and remote bindings Aug 9, 2026
@alongubkin
alongubkin force-pushed the alon/alien-476-ai-usage-observer branch from eb084cb to cdbb542 Compare August 14, 2026 03:40
@alongubkin
alongubkin force-pushed the alon/alien-476-fix-byo-cloudformation-permissions branch from 52b1d19 to 8ffcfa1 Compare August 14, 2026 03:40
@alongubkin
alongubkin force-pushed the alon/alien-476-ai-usage-observer branch from cdbb542 to d967476 Compare August 14, 2026 03:50
@alongubkin
alongubkin force-pushed the alon/alien-476-fix-byo-cloudformation-permissions branch from 8ffcfa1 to d83c072 Compare August 14, 2026 03:50
@alongubkin
alongubkin force-pushed the alon/alien-476-ai-usage-observer branch from d967476 to 683a0ad Compare August 14, 2026 12:41
@alongubkin
alongubkin force-pushed the alon/alien-476-fix-byo-cloudformation-permissions branch from d83c072 to bda0f5b Compare August 14, 2026 12:41
@alongubkin
alongubkin force-pushed the alon/alien-476-ai-usage-observer branch from 683a0ad to b487e1a Compare August 14, 2026 12:53
@alongubkin
alongubkin force-pushed the alon/alien-476-fix-byo-cloudformation-permissions branch from bda0f5b to 3a02054 Compare August 14, 2026 12:53
@alongubkin
alongubkin force-pushed the alon/alien-476-ai-usage-observer branch from b487e1a to 1115ece Compare August 14, 2026 12:59
@alongubkin
alongubkin force-pushed the alon/alien-476-fix-byo-cloudformation-permissions branch from 3a02054 to 12d6280 Compare August 14, 2026 12:59
@alongubkin
alongubkin force-pushed the alon/alien-476-ai-usage-observer branch from 1115ece to 68b2e52 Compare August 14, 2026 13:12
@alongubkin
alongubkin force-pushed the alon/alien-476-fix-byo-cloudformation-permissions branch from 12d6280 to 065d263 Compare August 14, 2026 13:13
@alongubkin
alongubkin force-pushed the alon/alien-476-ai-usage-observer branch from 68b2e52 to 3a16cf3 Compare August 14, 2026 14:03
@alongubkin
alongubkin force-pushed the alon/alien-476-fix-byo-cloudformation-permissions branch from 9f232c9 to 2fe3590 Compare August 14, 2026 14:15
@alongubkin
alongubkin force-pushed the alon/alien-476-ai-usage-observer branch from 3a16cf3 to b6c7168 Compare August 14, 2026 14:19
@alongubkin
alongubkin force-pushed the alon/alien-476-fix-byo-cloudformation-permissions branch from 2fe3590 to 952dcb5 Compare August 14, 2026 14:19
@alongubkin
alongubkin force-pushed the alon/alien-476-ai-usage-observer branch from b6c7168 to f22a99d Compare August 14, 2026 14:53
@alongubkin
alongubkin force-pushed the alon/alien-476-fix-byo-cloudformation-permissions branch 2 times, most recently from 8b53b03 to 63f0c0c Compare August 14, 2026 15:13
@alongubkin
alongubkin force-pushed the alon/alien-476-ai-usage-observer branch from d58def5 to 6406320 Compare August 14, 2026 15:33
@alongubkin
alongubkin force-pushed the alon/alien-476-fix-byo-cloudformation-permissions branch from 63f0c0c to 91768a7 Compare August 14, 2026 15:37
@alongubkin
alongubkin force-pushed the alon/alien-476-ai-usage-observer branch from 6406320 to 23f3279 Compare August 14, 2026 18:50
@alongubkin
alongubkin force-pushed the alon/alien-476-fix-byo-cloudformation-permissions branch from 6b35ed4 to f639a40 Compare August 14, 2026 18:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant