AWS access

How it works

Prized is an OpenID Connect identity provider for your boxes: the AWS CLI and SDKs exchange a box's signed token for temporary credentials with AssumeRoleWithWebIdentity, against a role your administrator controls.

aws sts get-caller-identity --profile acme
# {
#     "Arn": "arn:aws:sts::123456789012:assumed-role/prized-devbox/you@acme.com"
# }

Nothing to install or sign in to: each box's ~/.aws/config gets a [profile <name>] per connected role, read by aws, terraform, every SDK, and kubectl after aws eks update-kubeconfig. Credentials last an hour; the box renews its token itself, so a box running for a month still works.

Connect an AWS account

In Dashboard → Settings → General, under Cloud federation (owners only):

1. Click Connect on the Amazon Web Services row; the AWS console opens a pre-filled CloudFormation stack.
2. In the AWS account, review the role name and policies, tick the IAM acknowledgement, and click Create stack.
3. The role shows Connected only after AWS confirms that your workspace can assume it; until then, boxes get no AWS profile.

If someone else administers AWS, Copy the link and send it to them: it works once, for one hour, without a Prized account.

The stack creates the identity provider, a prized-devbox role with ReadOnlyAccess (both changeable before you create it), and a one-shot function that reports the role to Prized. A second workspace in the same AWS account sets CreateIdentityProvider to No (one provider per URL per account).

Connect a role you created yourself

To skip the stack:

1. Create the identity provider: URL https://prized.dev, audience sts.amazonaws.com.
2. Create a role whose trust policy allows sts:AssumeRoleWithWebIdentity from it, with prized.dev:aud = sts.amazonaws.com and prized.dev:sub like workspace:<your workspace id>:*.
3. Connect the role's ARN with the API.

Prized checks the role with AWS at once; the row shows Connected, or Check failed with what to fix. Verify rechecks; Remove ends it for every box.

A workspace can connect up to 10 roles, each its own profile. Members can see but not change them; a contractor's role does not include cloud federation.

What AWS sees

Each assumption carries the box's subject, workspace:<id>:box:<id>, and the box owner's email as the role session name, so CloudTrail shows assumed-role/prized-devbox/you@acme.com per person. Permissions are the role's; to pin a role to one box, put that box's id in the trust policy's sub condition.

On the box

Removing a role or closing the workspace clears its profile and token from every box within a few minutes. Boxes safe for third parties (every contractor's box among them) and boxes from an environment with Secret mounts off never get either, as with workspace secrets.

Deleting a box stops it from receiving new AWS identity tokens; so does removing a member or that member leaving the workspace, for all their boxes, whose managed profiles and token go on the next refresh. Tokens already issued remain valid until they expire, about an hour; temporary AWS credentials already obtained have their own expiry. To end existing AWS sessions sooner, revoke them in AWS.

Troubleshooting