Guide

AWS Endpoint

AWS endpoints connect Gateway to Amazon Web Services for governed cloud-infrastructure operations across services such as EC2, RDS, S3, and Lambda.

Endpoint Kind

Use aws as the endpoint kind when creating this endpoint through the API or dashboard.

What Gateway Uses This Endpoint For

Allow approved users and agents to inspect AWS infrastructure.
Centralize AWS credential handling and audit cloud operations.
Build runbooks that combine AWS state with Datadog, GitHub, and database context.
Support custom endpoints for local testing or compatible services.

Basic Endpoint Shape

json

{
  "endpoint": "aws-prod",
  "kind": "aws",
  "config": {
    "read_conn": {
      "provider": "aws",
      "region": "us-east-1",
      "access_key_id": "AKIA...",
      "secret_access_key": "secret"
    }
  }
}

Create it with the endpoint API:

bash

curl -sS -X POST "$EDEN/endpoints" \
  -H "$AUTH_HEADER" \
  -H "Content-Type: application/json" \
  -d '{
  "endpoint": "aws-prod",
  "kind": "aws",
  "config": {
    "read_conn": {
      "provider": "aws",
      "region": "us-east-1",
      "access_key_id": "AKIA...",
      "secret_access_key": "secret"
    }
  }
}'

Configuration Fields

Field	Purpose
`region`	AWS region
`access_key_id`	Access key ID
`secret_access_key`	Secret access key
`session_token`	Optional session token
`endpoint_url`	Optional custom endpoint URL

Credential Resolution

Provide access_key_id and secret_access_key together for explicit credentials. When neither is supplied, Eden resolves credentials through the standard AWS default credential chain, such as environment variables or an instance profile. session_token is supported with explicit temporary credentials.

When role_arn is configured, Eden calls STS AssumeRole, caches the temporary credentials with their expiration, and refreshes them before signing when they are within five minutes of expiry. Pooled AWS clients share a resolver so refresh work does not fan out duplicate STS calls.

Operating Notes

Prefer a least-privilege IAM identity and rotate credentials through the workload environment or endpoint configuration.
Separate read-only inspection endpoints from write-capable automation endpoints.
Use AWS IAM policies as the first line of least privilege, then layer Gateway RBAC on top.