Features

AWS Endpoint Governance

AWS endpoint governance is the AWS-specific layer on top of Eden's shared endpoint governance model. It centralizes SigV4 signing, credential refresh, STS role assumption, IAM read operations, and policy simulation through Eden endpoints and saved templates.

All AWS endpoints still use the common endpoint controls: endpoint RBAC, credential isolation, templates, audit evidence, backend profiles, and governed request routing.

Use AWS endpoint governance when Eden needs to call AWS APIs through centralized credentials, run IAM policy reads through saved templates, or use AWS IAM simulation as evidence for external permission checks.

Credential Handling

AWS endpoint credentials resolve in this order:

Use access_key_id and secret_access_key when both are supplied.
Otherwise use the AWS default credential chain.
If role_arn is supplied, call STS AssumeRole and sign requests with the temporary credentials.

Temporary credentials are cached with their provider expiration and refreshed before signing when they are within five minutes of expiry. AWS client pools share one credential resolver so pool startup and refresh do not fan out duplicate STS calls.

Endpoint Shape

json

{
  "endpoint": "aws-prod-governance",
  "kind": "aws",
  "config": {
    "target": {
      "region": "us-east-1"
    },
    "read_credentials": {
      "role_arn": "arn:aws:iam::123456789012:role/EdenRead",
      "role_session_name": "eden-prod-read"
    }
  }
}

Formatted config output redacts secret_access_key, session_token, and external_id; routing fields such as region, endpoint_url, role_arn, and role_session_name remain visible.

IAM Simulation Reads

AWS Read templates can call iam_simulate_principal_policy:

json

{
  "type": "iam_simulate_principal_policy",
  "policy_source_arn": "arn:aws:iam::123456789012:role/EdenRead",
  "action_names": ["s3:GetObject", "kms:Decrypt"],
  "resource_arns": ["arn:aws:s3:::regulated-documents/*"],
  "context_entries": [
    {
      "context_key_name": "aws:PrincipalTag/department",
      "context_key_values": ["records"],
      "context_key_type": "stringList"
    }
  ],
  "max_items": 100
}

max_items must be between 1 and 1000 when present. IAM simulation is a read operation: AWS evaluates policy and returns decisions without performing the simulated actions.

Security Posture

Control	Behavior
Credential refresh	Temporary credentials are refreshed before signing when they are close to expiration.
Pool sharing	Pooled AWS clients share one credential resolver to avoid duplicate STS calls.
Secret redaction	`secret_access_key`, `session_token`, and `external_id` are redacted from formatted config output.
Template execution	IAM reads run through saved Eden `Read` templates with normal template and endpoint permissions.
External permission checks	AWS IAM simulation allows only explicit allow decisions that cover the requested action/resource pairs.

Failure Behavior

Endpoint creation resolves credentials once and fails closed when credentials cannot be resolved. Runtime signing refreshes credentials before use; failed refresh, denied IAM simulation, malformed simulation output, or missing allow coverage blocks the configured check instead of silently allowing traffic.