Document AWS Bedrock IAM role setup for BYOLLM, including Oz cloud runs#92
Draft
IsaiahWitzke wants to merge 2 commits into
Draft
Document AWS Bedrock IAM role setup for BYOLLM, including Oz cloud runs#92IsaiahWitzke wants to merge 2 commits into
IsaiahWitzke wants to merge 2 commits into
Conversation
Rewrite the BYOLLM auth section to describe the OIDC + role-assumption flow that Warp actually uses for AWS Bedrock inference, and extend the docs to cover Oz cloud agent runs in addition to interactive terminal agents. Highlights: - Replace the local AWS CLI session-credentials path with a trust policy + permissions policy + AWS CLI setup script that admins follow once per team. - Use scoped_principal:<team-uid>/* in the trust policy so a single role works for human-triggered interactive and cloud runs as well as named-agent service-account runs. Note the full sub claim shape so admins can scope further if they want. - Update prerequisites, troubleshooting, and FAQ to match the new auth model. Companion to the Oz Bedrock plumbing on iw/add-aws-region-to-oz-runs in warp-server. Co-Authored-By: Oz <oz-agent@warp.dev>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…z section The team-wide trust policy (Step 2) is now scoped to scoped_principal:<team-uid>/user:* for human team members. Named-agent runs authenticate as service accounts, not users, so they need separate handling. Add a new top-level 'BYOLLM on Oz' section that covers the named-agent flow: - Explains the actor-type difference between human runs (user:<user-uid>) and named-agent runs (service_account:<service-account-uid>). - Provides two patterns for authorizing named agents: a wildcard service_account:* for all team agents, or per-UID conditions for a subset. - Documents how to find the team UID (Admin Panel) and named-agent UIDs (GET /api/v1/agent/identities or the Oz web app URL). - Documents the per-agent inference_providers.aws override in the public API, including role_arn / region / disabled and the trust-policy implications. Co-Authored-By: Oz <oz-agent@warp.dev>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents how enterprise AWS admins set up the IAM role + OIDC trust policy that lets Warp assume into their AWS account for AWS Bedrock inference. Companion to the Oz Bedrock plumbing on
iw/add-aws-region-to-oz-runsinwarp-server.The previous BYOLLM page described a local AWS CLI session-credentials flow (
aws login). This PR rewrites those sections to match how the warp client actually authenticates: short-lived credentials obtained via OIDC +sts:AssumeRoleWithWebIdentity. It also extends the docs to cover Oz cloud agent runs in addition to interactive terminal agents.What's covered
app.warp.devin prod,staging.warp.devin staging), restrictssubtoscoped_principal:<team-uid>/*, and requiresaudto equalsts.amazonaws.com. The/*wildcard matches both theuserandservice_accountactor types so a single role works for interactive terminal use, Oz cloud agent runs triggered by humans, and named-agent runs.bedrock:InvokeModel+bedrock:InvokeModelWithResponseStreamagainst foundation models and inference profiles.subshape —scoped_principal:<team-uid>/<actor-type>:<principal-uid>so admins who want to scope further (e.g./user:*or/service_account:*) know how.aws loginlocally" prerequisite/step/troubleshooting wording with the role-assumption flow. Removed the caveat that "Cloud agents do not yet support BYOLLM routing."Notes for reviewers
main(which had since been force-pushed and no longer contained those changes).Warp conversation