Seed and activate managed AWS SSO config #657

New issue

Closed

opened 2026-07-27 19:24:36 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-07-27 19:24:36 +00:00

Owner

Infrastructure commit 0b199e3 owns the refreshable AWS IAM Identity Center shared config. The current Windows config already uses [sso-session default], so the 30-day console duration needs no file key. The remaining activation is an attended cloud and host mutation.

Operator actions

Kai runs ward exec aws-sso-config-bootstrap from the infrastructure checkout. The tracked converger reads the existing local account id and start URL, creates only the two missing SecureString parameters under /coilysiren/aws-sso/, refuses any conflicting value, and writes the managed local config.
Kai runs ward exec aws-sso-config-check. The expected output is AWS config current.
Kai confirms [default] resolves ReadOnlyAccess and [profile admin] resolves AdministratorAccess through the guarded AWS identity surface. No parameter value belongs in the issue.
The operator adds the two parameter descriptions to agentic-os-kai/data/ssm-descriptions.yaml, runs ward exec ssm-index, and lands the generated inventory update.
From a Mac control host, the operator runs ward exec ansible-sync -- apply tags=aws-sso-config to converge the eligible Mac and tower WSL targets. kai-server and ser8 must remain on static readonly IAM credentials.

Expected evidence

Bootstrap reports two parameters created on the first run, or zero when they already exist, without printing values.
The local drift check is current.
Readonly is the default profile and admin is explicit.
The generated SSM inventory documents both parameter paths.
The scoped Ansible run changes only eligible SSO hosts and reports no secret diff.

This issue does not authorize overwriting an existing SSM value. Any conflict is a stop condition for the operator to inspect.

Infrastructure commit `0b199e3` owns the refreshable AWS IAM Identity Center shared config. The current Windows config already uses `[sso-session default]`, so the 30-day console duration needs no file key. The remaining activation is an attended cloud and host mutation. ## Operator actions 1. Kai runs `ward exec aws-sso-config-bootstrap` from the infrastructure checkout. The tracked converger reads the existing local account id and start URL, creates only the two missing SecureString parameters under `/coilysiren/aws-sso/`, refuses any conflicting value, and writes the managed local config. 2. Kai runs `ward exec aws-sso-config-check`. The expected output is `AWS config current`. 3. Kai confirms `[default]` resolves `ReadOnlyAccess` and `[profile admin]` resolves `AdministratorAccess` through the guarded AWS identity surface. No parameter value belongs in the issue. 4. The operator adds the two parameter descriptions to `agentic-os-kai/data/ssm-descriptions.yaml`, runs `ward exec ssm-index`, and lands the generated inventory update. 5. From a Mac control host, the operator runs `ward exec ansible-sync -- apply tags=aws-sso-config` to converge the eligible Mac and tower WSL targets. `kai-server` and `ser8` must remain on static readonly IAM credentials. ## Expected evidence * Bootstrap reports two parameters created on the first run, or zero when they already exist, without printing values. * The local drift check is current. * Readonly is the default profile and admin is explicit. * The generated SSM inventory documents both parameter paths. * The scoped Ansible run changes only eligible SSO hosts and reports no secret diff. This issue does not authorize overwriting an existing SSM value. Any conflict is a stop condition for the operator to inspect.

coilyco-ops added the

autonomy

live-collab

label

2026-07-27 19:24:36 +00:00

coilyco-ops

2026-07-29 03:46:32 +00:00

closed this issue
added the
priority
P4
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/infrastructure#657

No description provided.

Rows
Columns