Skip to content

feat: qualify BYO cloud access and remote bindings - #376

Draft
alongubkin wants to merge 11 commits into
alon/alien-476-ai-usage-observerfrom
alon/alien-476-fix-byo-cloudformation-permissions
Draft

feat: qualify BYO cloud access and remote bindings#376
alongubkin wants to merge 11 commits into
alon/alien-476-ai-usage-observerfrom
alon/alien-476-fix-byo-cloudformation-permissions

Conversation

@alongubkin

Copy link
Copy Markdown
Member

Summary

  • grant the generated AWS Management identity Bedrock model-availability access
  • grant the generated AWS Management identity only kms:DescribeKey for Enterprise Key observation
  • keep inference and cryptographic operations on the separate Access identity
  • validate the resulting role split in rendered CloudFormation resources

Verification

  • cargo test -p alien-cloudformation aws_remote_ai_permissions_attach_to_access_role
  • cargo test -p alien-cloudformation aws_key_template_is_valid_and_retained

Stack

Stacked on #375. Draft until real alien-test-target CloudFormation qualification completes.

@alongubkin alongubkin changed the title fix: grant BYO management observation access feat: qualify BYO cloud access and remote bindings Aug 9, 2026
alongubkin and others added 2 commits August 10, 2026 01:06
The gateway now strips the byo/ prefix in parse_model_request and lists
models with byo/-prefixed ids, matching the dashboard snippets.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant