Coding

GM2 Budget Control Infrastructure - Claude Reference

This is a Pulumi-based AWS infrastructure project that implements comprehensive budget control and cost management for team members with automated enforcement capabilities. The system uses a group-based IAM architecture with region restrictions, strict cost controls, and sophisticated tagging polici

promptBeginner5 min to valuemarkdown

0 views

Jan 23, 2026

Prompt Playground

1 Variables

Fill Variables

secrets.AWS_ROLE_ARN

Preview

# GM2 Budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Con[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol Inf[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] - Claud[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]f[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

## P[secrets.AWS_ROLE_ARN]oj[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]v[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN]w

Thi[secrets.AWS_ROLE_ARN] i[secrets.AWS_ROLE_ARN] a Pulumi-ba[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] inf[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] p[secrets.AWS_ROLE_ARN]oj[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]ha[secrets.AWS_ROLE_ARN] impl[secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]omp[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]iv[secrets.AWS_ROLE_ARN] budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol and [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] manag[secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] fo[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]am m[secrets.AWS_ROLE_ARN]mb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] wi[secrets.AWS_ROLE_ARN]h au[secrets.AWS_ROLE_ARN]oma[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN]nfo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]apabili[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Th[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]y[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]m u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] a g[secrets.AWS_ROLE_ARN]oup-ba[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d I[secrets.AWS_ROLE_ARN]M a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]hi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] wi[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN], [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN], and [secrets.AWS_ROLE_ARN]ophi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN]agging poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

## Majo[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]hi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Imp[secrets.AWS_ROLE_ARN]ov[secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] 🚀

### [secrets.AWS_ROLE_ARN]dvan[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d G[secrets.AWS_ROLE_ARN]oup-Ba[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d I[secrets.AWS_ROLE_ARN]M [secrets.AWS_ROLE_ARN]y[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]m (`[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/iam/`)

- **[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] G[secrets.AWS_ROLE_ARN]oup[secrets.AWS_ROLE_ARN]**: [secrets.AWS_ROLE_ARN]dminU[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], Iam[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN], In[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN], Billing[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ad[secrets.AWS_ROLE_ARN]nly[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
- **[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Manag[secrets.AWS_ROLE_ARN]d Poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] p[secrets.AWS_ROLE_ARN]odu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion-[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ady [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] manag[secrets.AWS_ROLE_ARN]d poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] fo[secrets.AWS_ROLE_ARN] admin and billing a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
- **P[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]**: U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]an hav[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] via `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion[secrets.AWS_ROLE_ARN]` pa[secrets.AWS_ROLE_ARN]am[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
- **[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-[secrets.AWS_ROLE_ARN]p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ifi[secrets.AWS_ROLE_ARN] Co[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Con[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN]**: In[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]yp[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN], volum[secrets.AWS_ROLE_ARN] limi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], and I[secrets.AWS_ROLE_ARN]M op[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion blo[secrets.AWS_ROLE_ARN]k[secrets.AWS_ROLE_ARN]
- **Billing T[secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN]pa[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]y**: [secrets.AWS_ROLE_ARN]ll u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] g[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ad-only billing a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] fo[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] awa[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

### [secrets.AWS_ROLE_ARN]nhan[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d Budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Con[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol [secrets.AWS_ROLE_ARN]y[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]m (`[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/`)

- **`[secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`**: C[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] I[secrets.AWS_ROLE_ARN]M u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] wi[secrets.AWS_ROLE_ARN]h g[secrets.AWS_ROLE_ARN]oup m[secrets.AWS_ROLE_ARN]mb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]hip[secrets.AWS_ROLE_ARN], pa[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]wo[secrets.AWS_ROLE_ARN]d poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], and a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] p[secrets.AWS_ROLE_ARN]ovi[secrets.AWS_ROLE_ARN]ioning
- **`[secrets.AWS_ROLE_ARN]nfo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`**: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]opi[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ady fo[secrets.AWS_ROLE_ARN] budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] al[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] ([secrets.AWS_ROLE_ARN]ambda [secrets.AWS_ROLE_ARN]nfo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] di[secrets.AWS_ROLE_ARN]abl[secrets.AWS_ROLE_ARN]d fo[secrets.AWS_ROLE_ARN] i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion)
- **U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-F[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]ndly Pa[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]wo[secrets.AWS_ROLE_ARN]d Poli[secrets.AWS_ROLE_ARN]y**: 8+ [secrets.AWS_ROLE_ARN]ha[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], mix[secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] + numb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], [secrets.AWS_ROLE_ARN]ymbol[secrets.AWS_ROLE_ARN] op[secrets.AWS_ROLE_ARN]ional

### [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ga[secrets.AWS_ROLE_ARN]y Poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] (`[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/` - D[secrets.AWS_ROLE_ARN]p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d)

- **`[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`**: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-p[secrets.AWS_ROLE_ARN]ivil[secrets.AWS_ROLE_ARN]g[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]mi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] ([secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]P[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]C[secrets.AWS_ROLE_ARN]D by g[secrets.AWS_ROLE_ARN]oup [secrets.AWS_ROLE_ARN]y[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]m)
- **`[secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`**: Co[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] ([secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]P[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]C[secrets.AWS_ROLE_ARN]D by g[secrets.AWS_ROLE_ARN]oup poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN])

### Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN]IDC Id[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]y P[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] (`[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/id[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]y-p[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/`)

- **`gi[secrets.AWS_ROLE_ARN]hub-oid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`**: C[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] I[secrets.AWS_ROLE_ARN]M [secrets.AWS_ROLE_ARN]IDC p[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] and [secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] fo[secrets.AWS_ROLE_ARN] Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] au[secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion
- **`[secrets.AWS_ROLE_ARN]yp[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`**: Typ[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ip[secrets.AWS_ROLE_ARN] in[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]fa[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] wi[secrets.AWS_ROLE_ARN]h Pulumi [secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]yp[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] fo[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]IDC [secrets.AWS_ROLE_ARN]onfigu[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion
- **`[secrets.AWS_ROLE_ARN]onfig[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`**: Gi[secrets.AWS_ROLE_ARN]Hub o[secrets.AWS_ROLE_ARN]ganiza[secrets.AWS_ROLE_ARN]ion and [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]po[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN]y [secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]onfigu[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]
- **T[secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: [secrets.AWS_ROLE_ARN]IDC f[secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion wi[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]po[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN]y-l[secrets.AWS_ROLE_ARN]v[secrets.AWS_ROLE_ARN]l a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol
- **Poli[secrets.AWS_ROLE_ARN]y [secrets.AWS_ROLE_ARN]uppo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: Bo[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] manag[secrets.AWS_ROLE_ARN]d and [secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om manag[secrets.AWS_ROLE_ARN]d poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] ([secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] au[secrets.AWS_ROLE_ARN]o-d[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion)

### Co[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Configu[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion

- **`[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/m[secrets.AWS_ROLE_ARN]mb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`**: [secrets.AWS_ROLE_ARN]nhan[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]am m[secrets.AWS_ROLE_ARN]mb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] d[secrets.AWS_ROLE_ARN]fini[secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] wi[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ay[secrets.AWS_ROLE_ARN] and a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] op[secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]
- **`[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/[secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`**: Global [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] wi[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gional and in[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]yp[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]
- **`[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/da[secrets.AWS_ROLE_ARN]hboa[secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`**: Cloud[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] moni[secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN]ing da[secrets.AWS_ROLE_ARN]hboa[secrets.AWS_ROLE_ARN]d
- **`[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/inf[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`**: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k ou[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] and d[secrets.AWS_ROLE_ARN]ploym[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]umma[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

## Command[secrets.AWS_ROLE_ARN]

### D[secrets.AWS_ROLE_ARN]v[secrets.AWS_ROLE_ARN]lopm[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]

- **Typ[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]king**: `bun [secrets.AWS_ROLE_ARN]un [secrets.AWS_ROLE_ARN]yp[secrets.AWS_ROLE_ARN]-[secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]k`
- **Pulumi p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN]w**: `pulumi p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN]w`
- **Pulumi d[secrets.AWS_ROLE_ARN]ploy**: `pulumi up`
- **Qui[secrets.AWS_ROLE_ARN]k d[secrets.AWS_ROLE_ARN]ploym[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]**: `bun [secrets.AWS_ROLE_ARN]un d[secrets.AWS_ROLE_ARN]ploy:lik[secrets.AWS_ROLE_ARN]-a-bo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]` (au[secrets.AWS_ROLE_ARN]o-login + d[secrets.AWS_ROLE_ARN]ploy)

### [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k Manag[secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]

- **[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k[secrets.AWS_ROLE_ARN]**: `pulumi [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k l[secrets.AWS_ROLE_ARN]`
- **[secrets.AWS_ROLE_ARN]wi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k**: `pulumi [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]l[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] <[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k-nam[secrets.AWS_ROLE_ARN]>`
- **G[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]ial[secrets.AWS_ROLE_ARN]**: `pulumi [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k ou[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN] u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]C[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]ial[secrets.AWS_ROLE_ARN] --[secrets.AWS_ROLE_ARN]how-[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] --j[secrets.AWS_ROLE_ARN]on`
- **G[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: `pulumi [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k ou[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] --[secrets.AWS_ROLE_ARN]how-[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] --j[secrets.AWS_ROLE_ARN]on`
- **G[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN]IDC p[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: `pulumi [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k ou[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN] gi[secrets.AWS_ROLE_ARN]hub[secrets.AWS_ROLE_ARN]IDCP[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n`
- **G[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: `pulumi [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k ou[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN] gi[secrets.AWS_ROLE_ARN]hub[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] --j[secrets.AWS_ROLE_ARN]on`
- **G[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] KM[secrets.AWS_ROLE_ARN] k[secrets.AWS_ROLE_ARN]y info**: `pulumi [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k ou[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN] km[secrets.AWS_ROLE_ARN]K[secrets.AWS_ROLE_ARN]y[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n`

### Pa[secrets.AWS_ROLE_ARN]kag[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ip[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] (pa[secrets.AWS_ROLE_ARN]kag[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]j[secrets.AWS_ROLE_ARN]on)

- **`bun [secrets.AWS_ROLE_ARN]un [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]up`**: [secrets.AWS_ROLE_ARN]ogin [secrets.AWS_ROLE_ARN]o [secrets.AWS_ROLE_ARN]3 [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] ba[secrets.AWS_ROLE_ARN]k[secrets.AWS_ROLE_ARN]nd
- **`bun [secrets.AWS_ROLE_ARN]un d[secrets.AWS_ROLE_ARN]ploy:[secrets.AWS_ROLE_ARN]af[secrets.AWS_ROLE_ARN]`**: [secrets.AWS_ROLE_ARN]ogin and d[secrets.AWS_ROLE_ARN]ploy wi[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN]onfi[secrets.AWS_ROLE_ARN]ma[secrets.AWS_ROLE_ARN]ion
- **`bun [secrets.AWS_ROLE_ARN]un d[secrets.AWS_ROLE_ARN]ploy:lik[secrets.AWS_ROLE_ARN]-a-bo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`**: [secrets.AWS_ROLE_ARN]ogin and d[secrets.AWS_ROLE_ARN]ploy wi[secrets.AWS_ROLE_ARN]hou[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]onfi[secrets.AWS_ROLE_ARN]ma[secrets.AWS_ROLE_ARN]ion ⚡

## [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]hi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] F[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

### [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]y & Co[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Con[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN]

- **G[secrets.AWS_ROLE_ARN]oup-Ba[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d P[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]mi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]**: U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] inh[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN] p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]mi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN]ough I[secrets.AWS_ROLE_ARN]M [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion g[secrets.AWS_ROLE_ARN]oup[secrets.AWS_ROLE_ARN]
- **[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Manag[secrets.AWS_ROLE_ARN]d Poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: P[secrets.AWS_ROLE_ARN]odu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion-[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ady poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] ([secrets.AWS_ROLE_ARN]dmini[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]Billing[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ad[secrets.AWS_ROLE_ARN]nly[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN])
- **P[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]**: [secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]h u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]an hav[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om allow[secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion[secrets.AWS_ROLE_ARN] o[secrets.AWS_ROLE_ARN] no [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] (via `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion[secrets.AWS_ROLE_ARN]` pa[secrets.AWS_ROLE_ARN]am[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN])
- **In[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Typ[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]**: [secrets.AWS_ROLE_ARN]2/[secrets.AWS_ROLE_ARN]3/[secrets.AWS_ROLE_ARN]3a/[secrets.AWS_ROLE_ARN]4g nano/mi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]o/[secrets.AWS_ROLE_ARN]mall only fo[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]C2 and [secrets.AWS_ROLE_ARN]D[secrets.AWS_ROLE_ARN] ([secrets.AWS_ROLE_ARN]xpand[secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]M [secrets.AWS_ROLE_ARN]uppo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN])
- **I[secrets.AWS_ROLE_ARN]M [secrets.AWS_ROLE_ARN]p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]**: P[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]v[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/g[secrets.AWS_ROLE_ARN]oup manag[secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] and p[secrets.AWS_ROLE_ARN]ivil[secrets.AWS_ROLE_ARN]g[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ala[secrets.AWS_ROLE_ARN]ion
- **U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-F[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]ndly Pa[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]wo[secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN]**: 8+ [secrets.AWS_ROLE_ARN]ha[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], mix[secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] + numb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], [secrets.AWS_ROLE_ARN]ymbol[secrets.AWS_ROLE_ARN] op[secrets.AWS_ROLE_ARN]ional (no[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]qui[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d)

### Budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]nfo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]

- **[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Topi[secrets.AWS_ROLE_ARN]**: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ady fo[secrets.AWS_ROLE_ARN] budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] al[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] in[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]g[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion
- **T[secrets.AWS_ROLE_ARN]am-wid[secrets.AWS_ROLE_ARN] Budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Moni[secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN]ing**: Cloud[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]h da[secrets.AWS_ROLE_ARN]hboa[secrets.AWS_ROLE_ARN]d fo[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] vi[secrets.AWS_ROLE_ARN]ualiza[secrets.AWS_ROLE_ARN]ion
- **P[secrets.AWS_ROLE_ARN]op[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Co[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Fil[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ing**: Tag[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]uppo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] wi[secrets.AWS_ROLE_ARN]h `C[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]dBy:u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]nam[secrets.AWS_ROLE_ARN]` fo[secrets.AWS_ROLE_ARN]ma[secrets.AWS_ROLE_ARN]
- **Individual Budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: F[secrets.AWS_ROLE_ARN]am[secrets.AWS_ROLE_ARN]wo[secrets.AWS_ROLE_ARN]k [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ady ([secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]ly di[secrets.AWS_ROLE_ARN]abl[secrets.AWS_ROLE_ARN]d fo[secrets.AWS_ROLE_ARN] i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion)
- **[secrets.AWS_ROLE_ARN]ambda [secrets.AWS_ROLE_ARN]nfo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]**: T[secrets.AWS_ROLE_ARN]mpo[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ily di[secrets.AWS_ROLE_ARN]abl[secrets.AWS_ROLE_ARN]d p[secrets.AWS_ROLE_ARN]nding d[secrets.AWS_ROLE_ARN]ploym[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] imp[secrets.AWS_ROLE_ARN]ov[secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

### T[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]hni[secrets.AWS_ROLE_ARN]al D[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ail[secrets.AWS_ROLE_ARN]

- **Typ[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ip[secrets.AWS_ROLE_ARN]**: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]onfigu[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion wi[secrets.AWS_ROLE_ARN]h bundl[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] modul[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]olu[secrets.AWS_ROLE_ARN]ion
- **Pa[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN]lia[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: `@/*` map[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]o `[secrets.AWS_ROLE_ARN]/[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/*` fo[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]l[secrets.AWS_ROLE_ARN]an impo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
- **Modul[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]olu[secrets.AWS_ROLE_ARN]ion**: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]qui[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]` [secrets.AWS_ROLE_ARN]x[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] fo[secrets.AWS_ROLE_ARN] bundl[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]ompa[secrets.AWS_ROLE_ARN]ibili[secrets.AWS_ROLE_ARN]y
- **[secrets.AWS_ROLE_ARN]un[secrets.AWS_ROLE_ARN]im[secrets.AWS_ROLE_ARN]**: [secrets.AWS_ROLE_ARN]od[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]j[secrets.AWS_ROLE_ARN] 20[secrets.AWS_ROLE_ARN]x [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ady fo[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]ambda fun[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]
- **[secrets.AWS_ROLE_ARN]DK**: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]DK v3 [secrets.AWS_ROLE_ARN]ompa[secrets.AWS_ROLE_ARN]ibl[secrets.AWS_ROLE_ARN]
- **⚠️ C[secrets.AWS_ROLE_ARN]ITIC[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: **[secrets.AWS_ROLE_ARN]od[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]j[secrets.AWS_ROLE_ARN] 23[secrets.AWS_ROLE_ARN]6[secrets.AWS_ROLE_ARN]0 o[secrets.AWS_ROLE_ARN] la[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]qui[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d** fo[secrets.AWS_ROLE_ARN] Pulumi op[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] (CI/CD wo[secrets.AWS_ROLE_ARN]kflow[secrets.AWS_ROLE_ARN] mu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]od[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]j[secrets.AWS_ROLE_ARN] 23+)

## Upda[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d Fil[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

```
[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/
   ├── iam/                        # 🆕 G[secrets.AWS_ROLE_ARN]oup-ba[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d I[secrets.AWS_ROLE_ARN]M [secrets.AWS_ROLE_ARN]y[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]m
   │   ├── g[secrets.AWS_ROLE_ARN]oup[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]              # [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] g[secrets.AWS_ROLE_ARN]oup[secrets.AWS_ROLE_ARN] wi[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] manag[secrets.AWS_ROLE_ARN]d poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
   │   └── ind[secrets.AWS_ROLE_ARN]x[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]               # I[secrets.AWS_ROLE_ARN]M [secrets.AWS_ROLE_ARN]xpo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
   ├── id[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]y-p[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/          # 🚀 Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN]IDC au[secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion
   │   ├── gi[secrets.AWS_ROLE_ARN]hub-oid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]         # [secrets.AWS_ROLE_ARN]IDC p[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] + I[secrets.AWS_ROLE_ARN]M [secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
   │   ├── [secrets.AWS_ROLE_ARN]yp[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]               # Typ[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ip[secrets.AWS_ROLE_ARN] in[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]fa[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
   │   ├── [secrets.AWS_ROLE_ARN]onfig[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]              # Gi[secrets.AWS_ROLE_ARN]Hub o[secrets.AWS_ROLE_ARN]g & [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]po [secrets.AWS_ROLE_ARN]onfigu[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion
   │   └── ind[secrets.AWS_ROLE_ARN]x[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]               # Id[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]y p[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]xpo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
   ├── budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/
   │   ├── [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]             # [secrets.AWS_ROLE_ARN]nhan[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion wi[secrets.AWS_ROLE_ARN]h g[secrets.AWS_ROLE_ARN]oup[secrets.AWS_ROLE_ARN]
   │   ├── [secrets.AWS_ROLE_ARN]nfo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]         # [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]opi[secrets.AWS_ROLE_ARN] ([secrets.AWS_ROLE_ARN]ambda di[secrets.AWS_ROLE_ARN]abl[secrets.AWS_ROLE_ARN]d)
   │   └── ind[secrets.AWS_ROLE_ARN]x[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]               # Budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]xpo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
   ├── poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/                  # 📦 [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ga[secrets.AWS_ROLE_ARN]y - b[secrets.AWS_ROLE_ARN]ing pha[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d ou[secrets.AWS_ROLE_ARN]
   │   ├── [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]             # [secrets.AWS_ROLE_ARN]ld [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]mi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]
   │   ├── [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]                # [secrets.AWS_ROLE_ARN]ld [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
   │   └── ind[secrets.AWS_ROLE_ARN]x[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]               # Poli[secrets.AWS_ROLE_ARN]y [secrets.AWS_ROLE_ARN]xpo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
   ├── lambda-[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/                # [secrets.AWS_ROLE_ARN]ambda [secrets.AWS_ROLE_ARN]ou[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] (di[secrets.AWS_ROLE_ARN]abl[secrets.AWS_ROLE_ARN]d)
   │   ├── ind[secrets.AWS_ROLE_ARN]x[secrets.AWS_ROLE_ARN]j[secrets.AWS_ROLE_ARN]               # [secrets.AWS_ROLE_ARN]nfo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] fun[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion
   │   └── pa[secrets.AWS_ROLE_ARN]kag[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]j[secrets.AWS_ROLE_ARN]on           # [secrets.AWS_ROLE_ARN]ambda d[secrets.AWS_ROLE_ARN]p[secrets.AWS_ROLE_ARN]nd[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
   ├── da[secrets.AWS_ROLE_ARN]hboa[secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]               # 🆕 Cloud[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] da[secrets.AWS_ROLE_ARN]hboa[secrets.AWS_ROLE_ARN]d
   ├── [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]               # Global [secrets.AWS_ROLE_ARN]onfigu[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion
   ├── m[secrets.AWS_ROLE_ARN]mb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]                 # [secrets.AWS_ROLE_ARN]nhan[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]am d[secrets.AWS_ROLE_ARN]fini[secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]
   ├── ind[secrets.AWS_ROLE_ARN]x[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]                   # 🆕 Main [secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]y poin[secrets.AWS_ROLE_ARN]
   └── inf[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]                   # [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k ou[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] & [secrets.AWS_ROLE_ARN]umma[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

📊 To[secrets.AWS_ROLE_ARN]al: ~1050 lin[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] of Typ[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ip[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]od[secrets.AWS_ROLE_ARN]
```

## K[secrets.AWS_ROLE_ARN]y Con[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] ([secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/[secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]) - UPD[secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN]D 🔄

- `[secrets.AWS_ROLE_ARN]DMI[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]M[secrets.AWS_ROLE_ARN]I[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`: Budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] al[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ipi[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] (`["jo[secrets.AWS_ROLE_ARN]g[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]lavijo@gm2d[secrets.AWS_ROLE_ARN]v[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om"]`)
- `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]D[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]GI[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`: **[secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN]ICT [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]GI[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] C[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]** - [secrets.AWS_ROLE_ARN]nly `["[secrets.AWS_ROLE_ARN]a-[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-1"]` ([secrets.AWS_ROLE_ARN]ou[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]a [secrets.AWS_ROLE_ARN]ão Paulo)
- `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]D[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]C2[secrets.AWS_ROLE_ARN]I[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]C[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`: **[secrets.AWS_ROLE_ARN]XP[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]D[secrets.AWS_ROLE_ARN]D [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]M [secrets.AWS_ROLE_ARN]UPP[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]T** - [secrets.AWS_ROLE_ARN]3/[secrets.AWS_ROLE_ARN]3a/[secrets.AWS_ROLE_ARN]4g/[secrets.AWS_ROLE_ARN]2 nano/mi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]o/[secrets.AWS_ROLE_ARN]mall (in[secrets.AWS_ROLE_ARN]lud[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]M in[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN])
- `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]D[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]D[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]I[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]C[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`: P[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]mi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN]D[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]la[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] (`db[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]3[secrets.AWS_ROLE_ARN]mi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]o`, `db[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]2[secrets.AWS_ROLE_ARN]mi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]o`)
- `F[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]C[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN]D[secrets.AWS_ROLE_ARN]TH[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]H[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]D`: Budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]hold fo[secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] k[secrets.AWS_ROLE_ARN]y di[secrets.AWS_ROLE_ARN]abling (100%)
- `BUDG[secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN]D[secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN]`: Budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]iod [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] ("2025-01-01[secrets.AWS_ROLE_ARN]00:00")

## [secrets.AWS_ROLE_ARN]nhan[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d M[secrets.AWS_ROLE_ARN]mb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Configu[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion ([secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/m[secrets.AWS_ROLE_ARN]mb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN])

### T[secrets.AWS_ROLE_ARN]amM[secrets.AWS_ROLE_ARN]mb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]hBudg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] In[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]fa[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

```[secrets.AWS_ROLE_ARN]yp[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ip[secrets.AWS_ROLE_ARN]
in[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]fa[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] T[secrets.AWS_ROLE_ARN]amM[secrets.AWS_ROLE_ARN]mb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]hBudg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] {
  u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]nam[secrets.AWS_ROLE_ARN]: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ing;
  [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]am[secrets.AWS_ROLE_ARN][]; // [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ay of [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]qui[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion/p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]mi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion g[secrets.AWS_ROLE_ARN]oup[secrets.AWS_ROLE_ARN]
  mon[secrets.AWS_ROLE_ARN]hlyBudg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]U[secrets.AWS_ROLE_ARN]D: numb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN];
  n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN]Con[secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]?: bool[secrets.AWS_ROLE_ARN]an; // [secrets.AWS_ROLE_ARN]p[secrets.AWS_ROLE_ARN]ional [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
  n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]K[secrets.AWS_ROLE_ARN]y?: bool[secrets.AWS_ROLE_ARN]an; // [secrets.AWS_ROLE_ARN]p[secrets.AWS_ROLE_ARN]ional p[secrets.AWS_ROLE_ARN]og[secrets.AWS_ROLE_ARN]amma[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
  [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion[secrets.AWS_ROLE_ARN]?: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion[]; // 🆕 P[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] (und[secrets.AWS_ROLE_ARN]fin[secrets.AWS_ROLE_ARN]d = no [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN])
  budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]l[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]?: {
    wa[secrets.AWS_ROLE_ARN]ningTh[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]hold: numb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN];
    [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]alTh[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]hold: numb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN];
    [secrets.AWS_ROLE_ARN]mail[secrets.AWS_ROLE_ARN]: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ing[];
  };
}
```

### [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] G[secrets.AWS_ROLE_ARN]oup[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]vailabl[secrets.AWS_ROLE_ARN] - UPD[secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN]D 🔄

- `"admin"` → [secrets.AWS_ROLE_ARN]dminU[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] g[secrets.AWS_ROLE_ARN]oup ([secrets.AWS_ROLE_ARN]dmini[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] manag[secrets.AWS_ROLE_ARN]d poli[secrets.AWS_ROLE_ARN]y)
- `"iam[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion"` → Iam[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] g[secrets.AWS_ROLE_ARN]oup (d[secrets.AWS_ROLE_ARN]ni[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] I[secrets.AWS_ROLE_ARN]M u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/g[secrets.AWS_ROLE_ARN]oup manag[secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN])
- `"in[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion"` → In[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] g[secrets.AWS_ROLE_ARN]oup ([secrets.AWS_ROLE_ARN]nfo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]2/[secrets.AWS_ROLE_ARN]3/[secrets.AWS_ROLE_ARN]3a/[secrets.AWS_ROLE_ARN]4g nano/mi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]o/[secrets.AWS_ROLE_ARN]mall only)
- **[secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN]oma[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]**: [secrets.AWS_ROLE_ARN]ll u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] g[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Billing[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ad[secrets.AWS_ROLE_ARN]nly[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] and G[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]alCo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]Con[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

### [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] - [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] 🆕

[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] now **p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]** in[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ad of global:

- **`[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion[secrets.AWS_ROLE_ARN]: ["[secrets.AWS_ROLE_ARN]a-[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-1"]`** → C[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-[secrets.AWS_ROLE_ARN]p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ifi[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion g[secrets.AWS_ROLE_ARN]oup
- **`[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion[secrets.AWS_ROLE_ARN]: und[secrets.AWS_ROLE_ARN]fin[secrets.AWS_ROLE_ARN]d`** → [secrets.AWS_ROLE_ARN]o [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] appli[secrets.AWS_ROLE_ARN]d
- [secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]h u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] g[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN] own `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion-{u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]nam[secrets.AWS_ROLE_ARN]}` g[secrets.AWS_ROLE_ARN]oup wi[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om poli[secrets.AWS_ROLE_ARN]y
- [secrets.AWS_ROLE_ARN]ppli[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]o [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]x[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]p[secrets.AWS_ROLE_ARN] global [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] (I[secrets.AWS_ROLE_ARN]M, [secrets.AWS_ROLE_ARN]ou[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]53, CloudF[secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN], [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN])

## Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN]IDC Id[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]y P[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Configu[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion

### [secrets.AWS_ROLE_ARN]v[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN]w

Th[secrets.AWS_ROLE_ARN] id[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]y p[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] modul[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]nabl[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] **k[secrets.AWS_ROLE_ARN]yl[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] au[secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion** fo[secrets.AWS_ROLE_ARN] Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] wo[secrets.AWS_ROLE_ARN]kflow[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]o [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] In[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ad of [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN]ing long-liv[secrets.AWS_ROLE_ARN]d a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] k[secrets.AWS_ROLE_ARN]y[secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]an a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]um[secrets.AWS_ROLE_ARN] I[secrets.AWS_ROLE_ARN]M [secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] di[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ly u[secrets.AWS_ROLE_ARN]ing [secrets.AWS_ROLE_ARN]IDC [secrets.AWS_ROLE_ARN]ok[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

### [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]hi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

```
Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN]kflow
    ↓ ([secrets.AWS_ROLE_ARN]IDC [secrets.AWS_ROLE_ARN]ok[secrets.AWS_ROLE_ARN]n wi[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]po [secrets.AWS_ROLE_ARN]laim)
[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] I[secrets.AWS_ROLE_ARN]M [secrets.AWS_ROLE_ARN]IDC P[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] ([secrets.AWS_ROLE_ARN]ok[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gi[secrets.AWS_ROLE_ARN]hubu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om)
    ↓ ([secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] poli[secrets.AWS_ROLE_ARN]y v[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ifi[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion)
I[secrets.AWS_ROLE_ARN]M [secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN] (gi[secrets.AWS_ROLE_ARN]hub-a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]-{[secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN]-id})
    ↓ ([secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]mpo[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]y [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]ial[secrets.AWS_ROLE_ARN] via [secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN])
[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] (wi[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN] p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]mi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN])
```

### Configu[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion (`[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/id[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]y-p[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/[secrets.AWS_ROLE_ARN]onfig[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`)

```[secrets.AWS_ROLE_ARN]yp[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ip[secrets.AWS_ROLE_ARN]
[secrets.AWS_ROLE_ARN]xpo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] gi[secrets.AWS_ROLE_ARN]hub[secrets.AWS_ROLE_ARN]IDCConfig: Gi[secrets.AWS_ROLE_ARN]Hub[secrets.AWS_ROLE_ARN]IDCP[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]Config = {
  gi[secrets.AWS_ROLE_ARN]hub[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ganiza[secrets.AWS_ROLE_ARN]ion: "you[secrets.AWS_ROLE_ARN]-o[secrets.AWS_ROLE_ARN]g",
  [secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]: [
    {
      id: "inf[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-admin-[secrets.AWS_ROLE_ARN]d",
      d[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ip[secrets.AWS_ROLE_ARN]ion: "[secrets.AWS_ROLE_ARN]dmin [secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN] fo[secrets.AWS_ROLE_ARN] inf[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] d[secrets.AWS_ROLE_ARN]ploym[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]",
      poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]: [
        "[secrets.AWS_ROLE_ARN]dmini[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]", // [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] manag[secrets.AWS_ROLE_ARN]d poli[secrets.AWS_ROLE_ARN]y
        // "a[secrets.AWS_ROLE_ARN]n:aw[secrets.AWS_ROLE_ARN]:iam::123:poli[secrets.AWS_ROLE_ARN]y/[secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om",  // Cu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om poli[secrets.AWS_ROLE_ARN]y wi[secrets.AWS_ROLE_ARN]h full [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
      ],
      [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]po[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]: ["inf[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]", "[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]afo[secrets.AWS_ROLE_ARN]m-modul[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]"],
    },
  ],
  p[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]Tag[secrets.AWS_ROLE_ARN]: {
    mo[secrets.AWS_ROLE_ARN]iv[secrets.AWS_ROLE_ARN]: "[secrets.AWS_ROLE_ARN]i-[secrets.AWS_ROLE_ARN]d gi[secrets.AWS_ROLE_ARN]hub a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]",
    Manag[secrets.AWS_ROLE_ARN]dBy: "Pulumi",
  },
};
```

### [secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN] Configu[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion

[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]uppo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]:

- **id**: Uniqu[secrets.AWS_ROLE_ARN] id[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]ifi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] ([secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN] nam[secrets.AWS_ROLE_ARN] b[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] `gi[secrets.AWS_ROLE_ARN]hub-a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]-{id}`)
- **d[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ip[secrets.AWS_ROLE_ARN]ion**: Human-[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]adabl[secrets.AWS_ROLE_ARN] pu[secrets.AWS_ROLE_ARN]po[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
- **poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ay of [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] manag[secrets.AWS_ROLE_ARN]d poli[secrets.AWS_ROLE_ARN]y nam[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] full [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] fo[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
- **[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]po[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ay of [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]po[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN]y nam[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] (wi[secrets.AWS_ROLE_ARN]hou[secrets.AWS_ROLE_ARN] o[secrets.AWS_ROLE_ARN]g p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]fix)

### T[secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Poli[secrets.AWS_ROLE_ARN]y

[secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN]oma[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]ally g[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d wi[secrets.AWS_ROLE_ARN]h:

- **[secrets.AWS_ROLE_ARN]ubj[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]ondi[secrets.AWS_ROLE_ARN]ion**: `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]po:{o[secrets.AWS_ROLE_ARN]g}/{[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]po}:*` (allow[secrets.AWS_ROLE_ARN] all b[secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], [secrets.AWS_ROLE_ARN]ag[secrets.AWS_ROLE_ARN], P[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] f[secrets.AWS_ROLE_ARN]om [secrets.AWS_ROLE_ARN]p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ifi[secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]po[secrets.AWS_ROLE_ARN])
- **[secrets.AWS_ROLE_ARN]udi[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]amazonaw[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om` ([secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]anda[secrets.AWS_ROLE_ARN]d fo[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN])
- **P[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]humbp[secrets.AWS_ROLE_ARN]in[secrets.AWS_ROLE_ARN]**: Gi[secrets.AWS_ROLE_ARN]Hub'[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]IDC [secrets.AWS_ROLE_ARN]humbp[secrets.AWS_ROLE_ARN]in[secrets.AWS_ROLE_ARN] (ha[secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN]od[secrets.AWS_ROLE_ARN]d, v[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ifi[secrets.AWS_ROLE_ARN]d)

### Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN]kflow U[secrets.AWS_ROLE_ARN]ag[secrets.AWS_ROLE_ARN]

```yaml
p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]mi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]:
  id-[secrets.AWS_ROLE_ARN]ok[secrets.AWS_ROLE_ARN]n: w[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] # [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]qui[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d fo[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]IDC
  [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ad

job[secrets.AWS_ROLE_ARN]:
  d[secrets.AWS_ROLE_ARN]ploy:
    [secrets.AWS_ROLE_ARN]un[secrets.AWS_ROLE_ARN]-on: ubun[secrets.AWS_ROLE_ARN]u-la[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
    [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]p[secrets.AWS_ROLE_ARN]:
      - nam[secrets.AWS_ROLE_ARN]: Configu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] C[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]ial[secrets.AWS_ROLE_ARN]
        u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]: aw[secrets.AWS_ROLE_ARN]-a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]/[secrets.AWS_ROLE_ARN]onfigu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-aw[secrets.AWS_ROLE_ARN]-[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]ial[secrets.AWS_ROLE_ARN]@v4
        wi[secrets.AWS_ROLE_ARN]h:
          [secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN]-[secrets.AWS_ROLE_ARN]o-a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]um[secrets.AWS_ROLE_ARN]: ${{ [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] }} # [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]g[secrets.AWS_ROLE_ARN], a[secrets.AWS_ROLE_ARN]n:aw[secrets.AWS_ROLE_ARN]:iam::123:[secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN]/gi[secrets.AWS_ROLE_ARN]hub-a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]-inf[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-admin-[secrets.AWS_ROLE_ARN]d
          aw[secrets.AWS_ROLE_ARN]-[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion: [secrets.AWS_ROLE_ARN]a-[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-1

      - nam[secrets.AWS_ROLE_ARN]: D[secrets.AWS_ROLE_ARN]ploy
        [secrets.AWS_ROLE_ARN]un: pulumi up --y[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
```

### [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]y F[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

- **[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]po[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN]y-l[secrets.AWS_ROLE_ARN]v[secrets.AWS_ROLE_ARN]l a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol**: [secrets.AWS_ROLE_ARN]nly [secrets.AWS_ROLE_ARN]p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ifi[secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]po[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]an a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]um[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
- **[secrets.AWS_ROLE_ARN]o long-liv[secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]ial[secrets.AWS_ROLE_ARN]**: T[secrets.AWS_ROLE_ARN]mpo[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]y [secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]ok[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]xpi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] au[secrets.AWS_ROLE_ARN]oma[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]ally
- **[secrets.AWS_ROLE_ARN]ild[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]d b[secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN]uppo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]po:o[secrets.AWS_ROLE_ARN]g/[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]po:*` allow[secrets.AWS_ROLE_ARN] all [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]f[secrets.AWS_ROLE_ARN] (main, f[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] b[secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], [secrets.AWS_ROLE_ARN]ag[secrets.AWS_ROLE_ARN])
- **[secrets.AWS_ROLE_ARN]udi[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ail**: CloudT[secrets.AWS_ROLE_ARN]ail log[secrets.AWS_ROLE_ARN] all [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]um[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]bId[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]y [secrets.AWS_ROLE_ARN]all[secrets.AWS_ROLE_ARN]

### [secrets.AWS_ROLE_ARN]dding [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]w [secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

1[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]di[secrets.AWS_ROLE_ARN] `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/id[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]y-p[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/[secrets.AWS_ROLE_ARN]onfig[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`
2[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]dd n[secrets.AWS_ROLE_ARN]w [secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]o `[secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]` a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ay
3[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]un `bun [secrets.AWS_ROLE_ARN]un [secrets.AWS_ROLE_ARN]yp[secrets.AWS_ROLE_ARN]-[secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]k` [secrets.AWS_ROLE_ARN]o v[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ify [secrets.AWS_ROLE_ARN]yp[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
4[secrets.AWS_ROLE_ARN] D[secrets.AWS_ROLE_ARN]ploy wi[secrets.AWS_ROLE_ARN]h `pulumi up`
5[secrets.AWS_ROLE_ARN] G[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]: `pulumi [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k ou[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN] gi[secrets.AWS_ROLE_ARN]hub[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] --j[secrets.AWS_ROLE_ARN]on`
6[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]dd [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN] Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]: `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]` (o[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om nam[secrets.AWS_ROLE_ARN])

### Poli[secrets.AWS_ROLE_ARN]y [secrets.AWS_ROLE_ARN]uppo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

**[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Manag[secrets.AWS_ROLE_ARN]d Poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]** (au[secrets.AWS_ROLE_ARN]o-[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]olv[secrets.AWS_ROLE_ARN]d):

- `"[secrets.AWS_ROLE_ARN]dmini[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]"`
- `"[secrets.AWS_ROLE_ARN]mazon[secrets.AWS_ROLE_ARN]C2Con[secrets.AWS_ROLE_ARN]ain[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]yPow[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]"`
- [secrets.AWS_ROLE_ARN]ny [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] manag[secrets.AWS_ROLE_ARN]d poli[secrets.AWS_ROLE_ARN]y nam[secrets.AWS_ROLE_ARN]

**Cu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om Manag[secrets.AWS_ROLE_ARN]d Poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]** ([secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]qui[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] full [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]):

- `"a[secrets.AWS_ROLE_ARN]n:aw[secrets.AWS_ROLE_ARN]:iam::123456789012:poli[secrets.AWS_ROLE_ARN]y/my-[secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om-poli[secrets.AWS_ROLE_ARN]y"`

Th[secrets.AWS_ROLE_ARN] modul[secrets.AWS_ROLE_ARN] au[secrets.AWS_ROLE_ARN]oma[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]ally d[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] whi[secrets.AWS_ROLE_ARN]h fo[secrets.AWS_ROLE_ARN]ma[secrets.AWS_ROLE_ARN] you'[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] u[secrets.AWS_ROLE_ARN]ing by [secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]king if [secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ing [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] wi[secrets.AWS_ROLE_ARN]h `"a[secrets.AWS_ROLE_ARN]n:"`[secrets.AWS_ROLE_ARN]

## Common I[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] & Fix[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

### ⚠️ [secrets.AWS_ROLE_ARN]od[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]j[secrets.AWS_ROLE_ARN] V[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]qui[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] (CI/CD)

**C[secrets.AWS_ROLE_ARN]ITIC[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: Thi[secrets.AWS_ROLE_ARN] p[secrets.AWS_ROLE_ARN]oj[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]qui[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] **[secrets.AWS_ROLE_ARN]od[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]j[secrets.AWS_ROLE_ARN] 23[secrets.AWS_ROLE_ARN]6[secrets.AWS_ROLE_ARN]0 o[secrets.AWS_ROLE_ARN] la[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]** [secrets.AWS_ROLE_ARN]o [secrets.AWS_ROLE_ARN]un Pulumi [secrets.AWS_ROLE_ARN]ommand[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

**P[secrets.AWS_ROLE_ARN]obl[secrets.AWS_ROLE_ARN]m**: Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] d[secrets.AWS_ROLE_ARN]faul[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]unn[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]od[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]j[secrets.AWS_ROLE_ARN] 20[secrets.AWS_ROLE_ARN]x, whi[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN]au[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Pulumi [secrets.AWS_ROLE_ARN]o fail[secrets.AWS_ROLE_ARN]

**[secrets.AWS_ROLE_ARN]olu[secrets.AWS_ROLE_ARN]ion**: Configu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] you[secrets.AWS_ROLE_ARN] CI/CD wo[secrets.AWS_ROLE_ARN]kflow [secrets.AWS_ROLE_ARN]o u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]od[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]j[secrets.AWS_ROLE_ARN] 23+:

```yaml
- nam[secrets.AWS_ROLE_ARN]: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]up [secrets.AWS_ROLE_ARN]od[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]j[secrets.AWS_ROLE_ARN]
  u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]: a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]/[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]up-nod[secrets.AWS_ROLE_ARN]@v4
  wi[secrets.AWS_ROLE_ARN]h:
    nod[secrets.AWS_ROLE_ARN]-v[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion: "23[secrets.AWS_ROLE_ARN]6[secrets.AWS_ROLE_ARN]0"
```

**[secrets.AWS_ROLE_ARN]hy**: Th[secrets.AWS_ROLE_ARN] p[secrets.AWS_ROLE_ARN]oj[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]'[secrets.AWS_ROLE_ARN] Typ[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ip[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]onfigu[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion and Pulumi op[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] d[secrets.AWS_ROLE_ARN]p[secrets.AWS_ROLE_ARN]nd on f[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] only availabl[secrets.AWS_ROLE_ARN] in [secrets.AWS_ROLE_ARN]od[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]j[secrets.AWS_ROLE_ARN] 23+[secrets.AWS_ROLE_ARN] In[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]alling [secrets.AWS_ROLE_ARN]od[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]j[secrets.AWS_ROLE_ARN] via Hom[secrets.AWS_ROLE_ARN]b[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]w in CI (whi[secrets.AWS_ROLE_ARN]h in[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]all[secrets.AWS_ROLE_ARN] v24) wo[secrets.AWS_ROLE_ARN]k[secrets.AWS_ROLE_ARN] bu[secrets.AWS_ROLE_ARN] i[secrets.AWS_ROLE_ARN] unn[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]y if you [secrets.AWS_ROLE_ARN]onfigu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion [secrets.AWS_ROLE_ARN]unn[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ly[secrets.AWS_ROLE_ARN]

### Impo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] I[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

- [secrets.AWS_ROLE_ARN]lway[secrets.AWS_ROLE_ARN] u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]` [secrets.AWS_ROLE_ARN]x[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] in impo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] du[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]o `"modul[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]olu[secrets.AWS_ROLE_ARN]ion": "bundl[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]"`
- [secrets.AWS_ROLE_ARN]xampl[secrets.AWS_ROLE_ARN]: `impo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] {[secrets.AWS_ROLE_ARN]om[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]hing} f[secrets.AWS_ROLE_ARN]om "[secrets.AWS_ROLE_ARN]/fil[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]"`
- Pa[secrets.AWS_ROLE_ARN]h alia[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]: `impo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] {[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]am[secrets.AWS_ROLE_ARN]} f[secrets.AWS_ROLE_ARN]om "@/iam"`

### Typ[secrets.AWS_ROLE_ARN] I[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

- Don'[secrets.AWS_ROLE_ARN] u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] `a[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]` fo[secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ay[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]ha[secrets.AWS_ROLE_ARN] n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN]o b[secrets.AWS_ROLE_ARN] mu[secrets.AWS_ROLE_ARN]abl[secrets.AWS_ROLE_ARN] in Pulumi
- U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gula[secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ay[secrets.AWS_ROLE_ARN]: `[secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]M[secrets.AWS_ROLE_ARN]I[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] = ["[secrets.AWS_ROLE_ARN]mail@domain[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om"]`

### Budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Fil[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ing

- U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] `:` [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]pa[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN] in [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] fil[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]: `"C[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]dBy:u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]nam[secrets.AWS_ROLE_ARN]"`
- [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]T `$` [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]pa[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN] whi[secrets.AWS_ROLE_ARN]h do[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n'[secrets.AWS_ROLE_ARN] wo[secrets.AWS_ROLE_ARN]k wi[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

### [secrets.AWS_ROLE_ARN]ambda [secrets.AWS_ROLE_ARN]un[secrets.AWS_ROLE_ARN]im[secrets.AWS_ROLE_ARN]

- U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] `aw[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]lambda[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]un[secrets.AWS_ROLE_ARN]im[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]od[secrets.AWS_ROLE_ARN]J[secrets.AWS_ROLE_ARN]20dX` (no[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ing [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN])
- [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]DK v3 modul[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]: `@aw[secrets.AWS_ROLE_ARN]-[secrets.AWS_ROLE_ARN]dk/[secrets.AWS_ROLE_ARN]li[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]-[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]`, `@aw[secrets.AWS_ROLE_ARN]-[secrets.AWS_ROLE_ARN]dk/[secrets.AWS_ROLE_ARN]li[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]-iam`

### G[secrets.AWS_ROLE_ARN]oup Manag[secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]

- U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] au[secrets.AWS_ROLE_ARN]oma[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]ally add[secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN]o g[secrets.AWS_ROLE_ARN]oup[secrets.AWS_ROLE_ARN] ba[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d on `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]` a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ay
- P[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion g[secrets.AWS_ROLE_ARN]oup[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d wh[secrets.AWS_ROLE_ARN]n `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion[secrets.AWS_ROLE_ARN]` pa[secrets.AWS_ROLE_ARN]am[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] i[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ifi[secrets.AWS_ROLE_ARN]d
- Co[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN]d a[secrets.AWS_ROLE_ARN] g[secrets.AWS_ROLE_ARN]oup l[secrets.AWS_ROLE_ARN]v[secrets.AWS_ROLE_ARN]l
- [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] wi[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om I[secrets.AWS_ROLE_ARN]M g[secrets.AWS_ROLE_ARN]oup[secrets.AWS_ROLE_ARN]

## [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k [secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]vailabl[secrets.AWS_ROLE_ARN]

### U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] C[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]ial[secrets.AWS_ROLE_ARN]

```ba[secrets.AWS_ROLE_ARN]h
pulumi [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k ou[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN] u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]C[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]ial[secrets.AWS_ROLE_ARN] --[secrets.AWS_ROLE_ARN]how-[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] --j[secrets.AWS_ROLE_ARN]on
```

[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]: `{ u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]nam[secrets.AWS_ROLE_ARN], a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]K[secrets.AWS_ROLE_ARN]yId, [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]K[secrets.AWS_ROLE_ARN]y }[]`

### Con[secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

```ba[secrets.AWS_ROLE_ARN]h
pulumi [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k ou[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] --[secrets.AWS_ROLE_ARN]how-[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] --j[secrets.AWS_ROLE_ARN]on
```

[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]: `{ u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]nam[secrets.AWS_ROLE_ARN], [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]mpo[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]yPa[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]wo[secrets.AWS_ROLE_ARN]d, pa[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]wo[secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]qui[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d, [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]oginU[secrets.AWS_ROLE_ARN]l }[]`

### Budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]umma[secrets.AWS_ROLE_ARN]y

[secrets.AWS_ROLE_ARN]vailabl[secrets.AWS_ROLE_ARN] in `inf[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]` [secrets.AWS_ROLE_ARN]xpo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] fo[secrets.AWS_ROLE_ARN] p[secrets.AWS_ROLE_ARN]og[secrets.AWS_ROLE_ARN]amma[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

### Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN]IDC P[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

```ba[secrets.AWS_ROLE_ARN]h
pulumi [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k ou[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN] gi[secrets.AWS_ROLE_ARN]hub[secrets.AWS_ROLE_ARN]IDCP[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n
```

[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]: `a[secrets.AWS_ROLE_ARN]n:aw[secrets.AWS_ROLE_ARN]:iam::[secrets.AWS_ROLE_ARN]CC[secrets.AWS_ROLE_ARN]U[secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN]ID:oid[secrets.AWS_ROLE_ARN]-p[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/[secrets.AWS_ROLE_ARN]ok[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gi[secrets.AWS_ROLE_ARN]hubu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om`

### Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

```ba[secrets.AWS_ROLE_ARN]h
pulumi [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k ou[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN] gi[secrets.AWS_ROLE_ARN]hub[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] --j[secrets.AWS_ROLE_ARN]on
```

[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]: `{ "[secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN]-id": "a[secrets.AWS_ROLE_ARN]n:aw[secrets.AWS_ROLE_ARN]:iam::[secrets.AWS_ROLE_ARN]CC[secrets.AWS_ROLE_ARN]U[secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN]ID:[secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN]/gi[secrets.AWS_ROLE_ARN]hub-a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]-[secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN]-id", [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] }`

### KM[secrets.AWS_ROLE_ARN] K[secrets.AWS_ROLE_ARN]y [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

```ba[secrets.AWS_ROLE_ARN]h
pulumi [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k ou[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN] km[secrets.AWS_ROLE_ARN]K[secrets.AWS_ROLE_ARN]y[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n
```

[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]: `a[secrets.AWS_ROLE_ARN]n:aw[secrets.AWS_ROLE_ARN]:km[secrets.AWS_ROLE_ARN]:[secrets.AWS_ROLE_ARN]a-[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-1:[secrets.AWS_ROLE_ARN]CC[secrets.AWS_ROLE_ARN]U[secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN]ID:k[secrets.AWS_ROLE_ARN]y/K[secrets.AWS_ROLE_ARN]Y[secrets.AWS_ROLE_ARN]ID`

## D[secrets.AWS_ROLE_ARN]ploym[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] Ch[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]kli[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

1[secrets.AWS_ROLE_ARN] ✅ [secrets.AWS_ROLE_ARN]un `bun [secrets.AWS_ROLE_ARN]un [secrets.AWS_ROLE_ARN]yp[secrets.AWS_ROLE_ARN]-[secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]k` - mu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] pa[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
2[secrets.AWS_ROLE_ARN] ✅ [secrets.AWS_ROLE_ARN]un `pulumi p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN]w` - [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN]w [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ou[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
3[secrets.AWS_ROLE_ARN] ✅ V[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ify all [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]am m[secrets.AWS_ROLE_ARN]mb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]mail[secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] in `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/m[secrets.AWS_ROLE_ARN]mb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]`
4[secrets.AWS_ROLE_ARN] ✅ Ch[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]k budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] amoun[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] and [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ay[secrets.AWS_ROLE_ARN]
5[secrets.AWS_ROLE_ARN] ✅ D[secrets.AWS_ROLE_ARN]ploy wi[secrets.AWS_ROLE_ARN]h `pulumi up`
6[secrets.AWS_ROLE_ARN] ✅ V[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ify u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]ial[secrets.AWS_ROLE_ARN] ou[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN]
7[secrets.AWS_ROLE_ARN] ✅ T[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] g[secrets.AWS_ROLE_ARN]oup m[secrets.AWS_ROLE_ARN]mb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]hip[secrets.AWS_ROLE_ARN] in [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Con[secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN]

## Cu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN] - P[secrets.AWS_ROLE_ARN]odu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ady 🚀

- **[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]hi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: [secrets.AWS_ROLE_ARN]dvan[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d g[secrets.AWS_ROLE_ARN]oup-ba[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d I[secrets.AWS_ROLE_ARN]M wi[secrets.AWS_ROLE_ARN]h p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]
- **[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ou[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: ~30+ [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ou[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] d[secrets.AWS_ROLE_ARN]ploy[secrets.AWS_ROLE_ARN]d (4 I[secrets.AWS_ROLE_ARN]M [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion g[secrets.AWS_ROLE_ARN]oup[secrets.AWS_ROLE_ARN], 1 [secrets.AWS_ROLE_ARN]IDC p[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], 3 Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], da[secrets.AWS_ROLE_ARN]hboa[secrets.AWS_ROLE_ARN]d, [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN])
- **T[secrets.AWS_ROLE_ARN]am Budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: $200/mon[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN]al
- **[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]iv[secrets.AWS_ROLE_ARN] M[secrets.AWS_ROLE_ARN]mb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: 1 u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] (ma[secrets.AWS_ROLE_ARN]ia-gonzal[secrets.AWS_ROLE_ARN]z) wi[secrets.AWS_ROLE_ARN]h admin + all [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] + [secrets.AWS_ROLE_ARN]a-[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-1 [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion lo[secrets.AWS_ROLE_ARN]k
- **Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN]IDC**: Configu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d fo[secrets.AWS_ROLE_ARN] CI/CD au[secrets.AWS_ROLE_ARN]oma[secrets.AWS_ROLE_ARN]ion wi[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]po[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN]y-l[secrets.AWS_ROLE_ARN]v[secrets.AWS_ROLE_ARN]l [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
- **[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]y**: [secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]p[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ady wi[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN]omp[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]iv[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN] and p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gional limi[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]
- **[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gional Con[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol**: **P[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]** - [secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]h u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]an hav[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om allow[secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion[secrets.AWS_ROLE_ARN] via `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion[secrets.AWS_ROLE_ARN]` pa[secrets.AWS_ROLE_ARN]am[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
- **In[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Typ[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: [secrets.AWS_ROLE_ARN]xpand[secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]M [secrets.AWS_ROLE_ARN]uppo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] ([secrets.AWS_ROLE_ARN]3a, [secrets.AWS_ROLE_ARN]4g) fo[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] op[secrets.AWS_ROLE_ARN]imiza[secrets.AWS_ROLE_ARN]ion
- **Pa[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]wo[secrets.AWS_ROLE_ARN]d Poli[secrets.AWS_ROLE_ARN]y**: U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-f[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]ndly (8+ [secrets.AWS_ROLE_ARN]ha[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], mix[secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] + numb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], [secrets.AWS_ROLE_ARN]ymbol[secrets.AWS_ROLE_ARN] op[secrets.AWS_ROLE_ARN]ional)
- **Budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] F[secrets.AWS_ROLE_ARN]am[secrets.AWS_ROLE_ARN]wo[secrets.AWS_ROLE_ARN]k**: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]opi[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ady, individual budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] di[secrets.AWS_ROLE_ARN]abl[secrets.AWS_ROLE_ARN]d fo[secrets.AWS_ROLE_ARN] i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion
- **Typ[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]af[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]y**: ✅ [secrets.AWS_ROLE_ARN]ll Typ[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ip[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]olv[secrets.AWS_ROLE_ARN]d wi[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] bundl[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]onfigu[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion
- **Co[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Da[secrets.AWS_ROLE_ARN]hboa[secrets.AWS_ROLE_ARN]d**: Cloud[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]h da[secrets.AWS_ROLE_ARN]hboa[secrets.AWS_ROLE_ARN]d fo[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]am [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] moni[secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN]ing
- **[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] P[secrets.AWS_ROLE_ARN]ovi[secrets.AWS_ROLE_ARN]ioning**: Bo[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN] and p[secrets.AWS_ROLE_ARN]og[secrets.AWS_ROLE_ARN]amma[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]uppo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d

## [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]x[secrets.AWS_ROLE_ARN] I[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion F[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

- [ ] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-[secrets.AWS_ROLE_ARN]nabl[secrets.AWS_ROLE_ARN] individual u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] wi[secrets.AWS_ROLE_ARN]h p[secrets.AWS_ROLE_ARN]op[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]ambda d[secrets.AWS_ROLE_ARN]ploym[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]
- [ ] [secrets.AWS_ROLE_ARN]dd CloudT[secrets.AWS_ROLE_ARN]ail in[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]g[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion fo[secrets.AWS_ROLE_ARN] d[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ail[secrets.AWS_ROLE_ARN]d u[secrets.AWS_ROLE_ARN]ag[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]king
- [ ] Impl[secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] au[secrets.AWS_ROLE_ARN]oma[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]po[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ing via [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/[secrets.AWS_ROLE_ARN]mail
- [ ] [secrets.AWS_ROLE_ARN]dd [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] anomaly d[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion
- [ ] [secrets.AWS_ROLE_ARN]xpand [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]ov[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ag[secrets.AWS_ROLE_ARN] (add mo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN])

## [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] Majo[secrets.AWS_ROLE_ARN] Imp[secrets.AWS_ROLE_ARN]ov[secrets.AWS_ROLE_ARN]m[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] ([secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Commi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]) 🚀

### [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]T: "f[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]: p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]"

- **B[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]KI[secrets.AWS_ROLE_ARN]G**: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]pla[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d global [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] wi[secrets.AWS_ROLE_ARN]h p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol
- **[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] P[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]M[secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: [secrets.AWS_ROLE_ARN]dd[secrets.AWS_ROLE_ARN]d `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion[secrets.AWS_ROLE_ARN]?: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion[]` [secrets.AWS_ROLE_ARN]o T[secrets.AWS_ROLE_ARN]amM[secrets.AWS_ROLE_ARN]mb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]hBudg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] in[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]fa[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
- **P[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] G[secrets.AWS_ROLE_ARN]oup[secrets.AWS_ROLE_ARN]**: [secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]h u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] wi[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] g[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN] own I[secrets.AWS_ROLE_ARN]M g[secrets.AWS_ROLE_ARN]oup
- **Fl[secrets.AWS_ROLE_ARN]xibl[secrets.AWS_ROLE_ARN] Con[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol**: U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]an hav[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om allow[secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion[secrets.AWS_ROLE_ARN] o[secrets.AWS_ROLE_ARN] no [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]
- **Typ[secrets.AWS_ROLE_ARN]-[secrets.AWS_ROLE_ARN]af[secrets.AWS_ROLE_ARN]**: U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion` [secrets.AWS_ROLE_ARN]yp[secrets.AWS_ROLE_ARN] f[secrets.AWS_ROLE_ARN]om [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] fo[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion valida[secrets.AWS_ROLE_ARN]ion

### "f[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]: Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN]IDC Id[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]y P[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]"

- **[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] M[secrets.AWS_ROLE_ARN]DU[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: Compl[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]IDC au[secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion [secrets.AWS_ROLE_ARN]y[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]m (`[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/id[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]y-p[secrets.AWS_ROLE_ARN]ovid[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/`)
- **K[secrets.AWS_ROLE_ARN]yl[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] CI/CD**: [secrets.AWS_ROLE_ARN]limina[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d fo[secrets.AWS_ROLE_ARN] long-liv[secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] k[secrets.AWS_ROLE_ARN]y[secrets.AWS_ROLE_ARN] in Gi[secrets.AWS_ROLE_ARN]Hub [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
- **Typ[secrets.AWS_ROLE_ARN]-[secrets.AWS_ROLE_ARN]af[secrets.AWS_ROLE_ARN]**: Full Typ[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ip[secrets.AWS_ROLE_ARN] wi[secrets.AWS_ROLE_ARN]h Pulumi [secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]yp[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
- **Fl[secrets.AWS_ROLE_ARN]xibl[secrets.AWS_ROLE_ARN]**: [secrets.AWS_ROLE_ARN]uppo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] manag[secrets.AWS_ROLE_ARN]d and [secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om manag[secrets.AWS_ROLE_ARN]d poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
- **[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]po[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN]y-l[secrets.AWS_ROLE_ARN]v[secrets.AWS_ROLE_ARN]l [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: Fin[secrets.AWS_ROLE_ARN]-g[secrets.AWS_ROLE_ARN]ain[secrets.AWS_ROLE_ARN]d a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]po
- **P[secrets.AWS_ROLE_ARN]odu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion-[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ady**: 4 fil[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], ~140 [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]C, full [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]ov[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ag[secrets.AWS_ROLE_ARN]

### dd54226: "f[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]: only [secrets.AWS_ROLE_ARN]a-[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-1 [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion allow[secrets.AWS_ROLE_ARN]d"

- **[secrets.AWS_ROLE_ARN]UP[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]D[secrets.AWS_ROLE_ARN]D**: [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]pla[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d by p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]
- [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]iginally [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]o [secrets.AWS_ROLE_ARN]a-[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-1 [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion only
- [secrets.AWS_ROLE_ARN]ow u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]an hav[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN]onfigu[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]

### [secrets.AWS_ROLE_ARN]8d42d0: "f[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]: upda[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] in[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]yp[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]"

- **[secrets.AWS_ROLE_ARN]XP[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]D[secrets.AWS_ROLE_ARN]D**: [secrets.AWS_ROLE_ARN]dd[secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]M in[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]uppo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] ([secrets.AWS_ROLE_ARN]3a, [secrets.AWS_ROLE_ARN]4g) fo[secrets.AWS_ROLE_ARN] b[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] p[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]fo[secrets.AWS_ROLE_ARN]man[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
- Co[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] op[secrets.AWS_ROLE_ARN]imiza[secrets.AWS_ROLE_ARN]ion [secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN]ough mod[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]M-ba[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d in[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
- Main[secrets.AWS_ROLE_ARN]ain[secrets.AWS_ROLE_ARN]d [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]iz[secrets.AWS_ROLE_ARN] limi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] (nano/mi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]o/[secrets.AWS_ROLE_ARN]mall only)

## P[secrets.AWS_ROLE_ARN]odu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ivi[secrets.AWS_ROLE_ARN]y Tip[secrets.AWS_ROLE_ARN] fo[secrets.AWS_ROLE_ARN] Claud[secrets.AWS_ROLE_ARN] Cod[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] 💡

### K[secrets.AWS_ROLE_ARN]y Pa[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]o Follow

1[secrets.AWS_ROLE_ARN] **[secrets.AWS_ROLE_ARN]lway[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]k [secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] fi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]/[secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]` ha[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN] la[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]
2[secrets.AWS_ROLE_ARN] **[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion[secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] P[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: [secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]h u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]an hav[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion[secrets.AWS_ROLE_ARN]` pa[secrets.AWS_ROLE_ARN]am[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] o[secrets.AWS_ROLE_ARN] no [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]
3[secrets.AWS_ROLE_ARN] **In[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]an[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]yp[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]T[secrets.AWS_ROLE_ARN]ICT**: [secrets.AWS_ROLE_ARN]nly [secrets.AWS_ROLE_ARN]2/[secrets.AWS_ROLE_ARN]3/[secrets.AWS_ROLE_ARN]3a/[secrets.AWS_ROLE_ARN]4g nano/mi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]o/[secrets.AWS_ROLE_ARN]mall allow[secrets.AWS_ROLE_ARN]d
4[secrets.AWS_ROLE_ARN] **G[secrets.AWS_ROLE_ARN]oup m[secrets.AWS_ROLE_ARN]mb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]hip i[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]UT[secrets.AWS_ROLE_ARN]M[secrets.AWS_ROLE_ARN]TIC**: U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] join g[secrets.AWS_ROLE_ARN]oup[secrets.AWS_ROLE_ARN] ba[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d on `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]` a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ay
5[secrets.AWS_ROLE_ARN] **[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion g[secrets.AWS_ROLE_ARN]oup[secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] DY[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]MIC**: C[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] wh[secrets.AWS_ROLE_ARN]n `[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion[secrets.AWS_ROLE_ARN]` pa[secrets.AWS_ROLE_ARN]am[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] i[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ifi[secrets.AWS_ROLE_ARN]d
6[secrets.AWS_ROLE_ARN] **Budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]y[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]m i[secrets.AWS_ROLE_ARN] DI[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]B[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]D**: Fo[secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN] on [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol [secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN]ough poli[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN], no[secrets.AWS_ROLE_ARN] budg[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

### Qui[secrets.AWS_ROLE_ARN]k Command[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]f[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

```ba[secrets.AWS_ROLE_ARN]h
# Typ[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]k (alway[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]un fi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN])
bun [secrets.AWS_ROLE_ARN]un [secrets.AWS_ROLE_ARN]yp[secrets.AWS_ROLE_ARN]-[secrets.AWS_ROLE_ARN]h[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]k

# P[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN]w [secrets.AWS_ROLE_ARN]hang[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
pulumi p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]vi[secrets.AWS_ROLE_ARN]w

# D[secrets.AWS_ROLE_ARN]ploy (wi[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN]onfi[secrets.AWS_ROLE_ARN]ma[secrets.AWS_ROLE_ARN]ion)
pulumi up

# D[secrets.AWS_ROLE_ARN]ploy (au[secrets.AWS_ROLE_ARN]o-[secrets.AWS_ROLE_ARN]onfi[secrets.AWS_ROLE_ARN]m)
bun [secrets.AWS_ROLE_ARN]un d[secrets.AWS_ROLE_ARN]ploy:lik[secrets.AWS_ROLE_ARN]-a-bo[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

# G[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]ial[secrets.AWS_ROLE_ARN]
pulumi [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k ou[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN] u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]C[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN]ial[secrets.AWS_ROLE_ARN] --[secrets.AWS_ROLE_ARN]how-[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] --j[secrets.AWS_ROLE_ARN]on

# G[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN] a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
pulumi [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k ou[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] --[secrets.AWS_ROLE_ARN]how-[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] --j[secrets.AWS_ROLE_ARN]on

# G[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] KM[secrets.AWS_ROLE_ARN] k[secrets.AWS_ROLE_ARN]y [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
pulumi [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]k ou[secrets.AWS_ROLE_ARN]pu[secrets.AWS_ROLE_ARN] km[secrets.AWS_ROLE_ARN]K[secrets.AWS_ROLE_ARN]y[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n
```

### Cu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]hi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] P[secrets.AWS_ROLE_ARN]io[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]

1[secrets.AWS_ROLE_ARN] **Co[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Con[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol Fi[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: [secrets.AWS_ROLE_ARN]v[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]y [secrets.AWS_ROLE_ARN]hang[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]hould main[secrets.AWS_ROLE_ARN]ain o[secrets.AWS_ROLE_ARN] imp[secrets.AWS_ROLE_ARN]ov[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]on[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ol[secrets.AWS_ROLE_ARN]
2[secrets.AWS_ROLE_ARN] **P[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Fl[secrets.AWS_ROLE_ARN]xibili[secrets.AWS_ROLE_ARN]y**: [secrets.AWS_ROLE_ARN]llow [secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]om [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN] p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
3[secrets.AWS_ROLE_ARN] **U[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]xp[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]n[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]**: Balan[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]u[secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN]y wi[secrets.AWS_ROLE_ARN]h u[secrets.AWS_ROLE_ARN]abili[secrets.AWS_ROLE_ARN]y
4[secrets.AWS_ROLE_ARN] **Typ[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]af[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]y**: Main[secrets.AWS_ROLE_ARN]ain [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Typ[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ip[secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]onfigu[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]ion wi[secrets.AWS_ROLE_ARN]h [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN]yp[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]
5[secrets.AWS_ROLE_ARN] **P[secrets.AWS_ROLE_ARN]odu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ady**: [secrets.AWS_ROLE_ARN]ll [secrets.AWS_ROLE_ARN]hang[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN]hould b[secrets.AWS_ROLE_ARN] p[secrets.AWS_ROLE_ARN]odu[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion-g[secrets.AWS_ROLE_ARN]ad[secrets.AWS_ROLE_ARN]

---

[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] Upda[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d: Ba[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]d on "f[secrets.AWS_ROLE_ARN]a[secrets.AWS_ROLE_ARN]: p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]-u[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]gion [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]i[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]ion[secrets.AWS_ROLE_ARN]" [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]fa[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]o[secrets.AWS_ROLE_ARN] - [secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]p[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN]mb[secrets.AWS_ROLE_ARN][secrets.AWS_ROLE_ARN] 2025[secrets.AWS_ROLE_ARN]

GM2 Budget Control Infrastructure - Claude Reference

Project Overview

Major Architecture Improvements 🚀

Advanced Group-Based IAM System (

src/iam/

)

Service Groups: AdminUsers, IamRestrictions, InstancesRestrictions, BillingReadOnlyAccessUsers
AWS Managed Policies: Uses production-ready AWS managed policies for admin and billing access
Per-User Region Restrictions: Users can have custom region restrictions via
```
regions
```
parameter
Service-Specific Cost Controls: Instance type restrictions, volume limits, and IAM operation blocks
Billing Transparency: All users get read-only billing access for cost awareness

Enhanced Budget Control System (

src/budget/

)

control.ts
: Creates IAM users with group memberships, password policies, and access provisioning
enforcement.ts
: SNS topic ready for budget alerts (Lambda enforcement disabled for iteration)
User-Friendly Password Policy: 8+ characters, mixed case + numbers, symbols optional

Legacy Policies (

src/policies/

- Deprecated)

service.ts
: Least-privilege service permissions (REPLACED by group system)
cost.ts
: Cost control policies (REPLACED by group policies)

GitHub OIDC Identity Provider (

src/identity-provider/

)

github-oidc.ts
: Creates IAM OIDC provider and roles for GitHub Actions authentication
types.ts
: TypeScript interfaces with Pulumi Output types for OIDC configuration
config.ts
: GitHub organization and repository role configurations
Trust Policies: OIDC federation with repository-level access control
Policy Support: Both AWS managed and custom managed policies (ARN auto-detection)

Core Configuration

src/members.ts
: Enhanced team member definitions with service arrays and access options
src/constants.ts
: Global constants with strict regional and instance type restrictions
src/dashboard.ts
: CloudWatch cost monitoring dashboard
src/infra.ts
: Stack outputs and deployment summaries

Commands

Development

Type checking:
```
bun run type-check
```
Pulumi preview:
```
pulumi preview
```
Pulumi deploy:
```
pulumi up
```
Quick deployment:
```
bun run deploy:like-a-boss
```
(auto-login + deploy)

Stack Management

List stacks:
```
pulumi stack ls
```
Switch stack:
```
pulumi stack select <stack-name>
```

Get user credentials:

pulumi stack output userCredentials --show-secrets --json

Get console access:

pulumi stack output consoleAccess --show-secrets --json

Get GitHub OIDC provider ARN:

pulumi stack output githubOIDCProviderArn

Get GitHub Actions role ARNs:

pulumi stack output githubActionsRoleArns --json

Get KMS key info:
```
pulumi stack output kmsKeyArn
```

Package Scripts (package.json)

bun run setup
: Login to S3 state backend
bun run deploy:safe
: Login and deploy with confirmation
bun run deploy:like-a-boss
: Login and deploy without confirmation ⚡

Architecture Features

Security & Cost Controls

Group-Based Permissions: Users inherit permissions through IAM restriction groups
AWS Managed Policies: Production-ready policies (AdministratorAccess, AWSBillingReadOnlyAccess)
Per-User Region Restrictions: Each user can have custom allowed regions or no restrictions (via
```
regions
```
parameter)
Instance Type Restrictions: t2/t3/t3a/t4g nano/micro/small only for EC2 and RDS (expanded ARM support)
IAM Operation Restrictions: Prevents user/group management and privilege escalation
User-Friendly Passwords: 8+ chars, mixed case + numbers, symbols optional (not required)

Budget Enforcement

SNS Topic: Ready for budget alert integration
Team-wide Budget Monitoring: CloudWatch dashboard for cost visualization
Proper Cost Filtering: Tags support with
```
CreatedBy:username
```
format
Individual Budgets: Framework ready (currently disabled for iteration)
Lambda Enforcement: Temporarily disabled pending deployment improvements

Technical Details

TypeScript: Strict configuration with bundler module resolution
Path Aliases:
```
@/*
```
maps to
```
./src/*
```
for clean imports
Module Resolution: Requires
```
.ts
```
extensions for bundler compatibility
Runtime: Node.js 20.x ready for Lambda functions
SDK: AWS SDK v3 compatible
⚠️ CRITICAL: Node.js 23.6.0 or later required for Pulumi operations (CI/CD workflows must use Node.js 23+)

Updated File Structure

src/
   ├── iam/                        # 🆕 Group-based IAM system
   │   ├── groups.ts              # Service groups with AWS managed policies
   │   └── index.ts               # IAM exports
   ├── identity-provider/          # 🚀 GitHub OIDC authentication
   │   ├── github-oidc.ts         # OIDC provider + IAM roles
   │   ├── types.ts               # TypeScript interfaces
   │   ├── config.ts              # GitHub org & repo configuration
   │   └── index.ts               # Identity provider exports
   ├── budget/
   │   ├── control.ts             # Enhanced user creation with groups
   │   ├── enforcement.ts         # SNS topic (Lambda disabled)
   │   └── index.ts               # Budget exports
   ├── policies/                  # 📦 Legacy - being phased out
   │   ├── service.ts             # Old service permissions
   │   ├── cost.ts                # Old cost control policies
   │   └── index.ts               # Policy exports
   ├── lambda-src/                # Lambda source (disabled)
   │   ├── index.js               # Enforcement function
   │   └── package.json           # Lambda dependencies
   ├── dashboard.ts               # 🆕 CloudWatch cost dashboard
   ├── constants.ts               # Global configuration
   ├── members.ts                 # Enhanced team definitions
   ├── index.ts                   # 🆕 Main entry point
   └── infra.ts                   # Stack outputs & summaries

📊 Total: ~1050 lines of TypeScript code

Key Constants (src/constants.ts) - UPDATED 🔄

```
ADMIN_EMAILS
```
: Budget alert recipients (
```
["[email protected]"]
```
)
```
ALLOWED_REGIONS
```
: STRICT REGIONAL CONTROL - Only
```
["sa-east-1"]
```
(South America São Paulo)
```
ALLOWED_EC2_INSTANCES
```
: EXPANDED ARM SUPPORT - t3/t3a/t4g/t2 nano/micro/small (includes ARM instances)

ALLOWED_RDS_INSTANCES

: Permitted RDS classes (

db.t3.micro

db.t2.micro

)

```
FORECASTED_THRESHOLD
```
: Budget threshold for access key disabling (100%)
```
BUDGET_START_DATE
```
: Budget period start ("2025-01-01_00:00")

Enhanced Member Configuration (src/members.ts)

TeamMemberWithBudget Interface

interface TeamMemberWithBudget {
  username: string;
  services: ServiceName[]; // Array of required restriction/permission groups
  monthlyBudgetUSD: number;
  needsConsoleAccess?: boolean; // Optional console access
  needsAccessKey?: boolean; // Optional programmatic access
  regions?: Region[]; // 🆕 Per-user region restrictions (undefined = no restrictions)
  budgetAlerts?: {
    warningThreshold: number;
    criticalThreshold: number;
    emails: string[];
  };
}

Service Groups Available - UPDATED 🔄

```
"admin"
```
→ AdminUsers group (AdministratorAccess AWS managed policy)
```
"iamRestriction"
```
→ IamRestrictions group (denies IAM user/group management)
```
"instancesRestriction"
```
→ InstancesRestrictions group (enforces t2/t3/t3a/t4g nano/micro/small only)
Automatic: All users get BillingReadOnlyAccess and GeneralCostControl policies

Region Restrictions - NEW 🆕

Region restrictions are now per-user instead of global:

regions: ["sa-east-1"]
→ Creates user-specific region restriction group
regions: undefined
→ No region restrictions applied
Each user gets their own
```
RegionRestriction-{username}
```
group with custom policy
Applies to ALL AWS services except global services (IAM, Route53, CloudFront, etc.)

GitHub OIDC Identity Provider Configuration

Overview

The identity provider module enables keyless authentication for GitHub Actions workflows to AWS. Instead of storing long-lived access keys as secrets, GitHub Actions can assume IAM roles directly using OIDC tokens.

Architecture

GitHub Actions Workflow
    ↓ (OIDC token with repo claim)
AWS IAM OIDC Provider (token.actions.githubusercontent.com)
    ↓ (trust policy verification)
IAM Role (github-actions-{role-id})
    ↓ (temporary credentials via STS)
AWS Services (with role permissions)

Configuration (

src/identity-provider/config.ts

)

export const githubOIDCConfig: GitHubOIDCProviderConfig = {
  githubOrganization: "your-org",
  roles: [
    {
      id: "infrastructure-admin-cd",
      description: "Admin role for infrastructure deployment",
      policies: [
        "AdministratorAccess", // AWS managed policy
        // "arn:aws:iam::123:policy/custom",  // Custom policy with full ARN
      ],
      repositories: ["infrastructure", "terraform-modules"],
    },
  ],
  providerTags: {
    motive: "ci-cd github actions",
    ManagedBy: "Pulumi",
  },
};

Role Configuration

Each role supports:

id: Unique identifier (role name becomes
```
github-actions-{id}
```
)
description: Human-readable purpose
policies: Array of AWS managed policy names OR full ARNs for custom policies
repositories: Array of repository names (without org prefix)

Trust Policy

Automatically generated with:

Subject condition:
```
repo:{org}/{repo}:*
```
(allows all branches, tags, PRs from specified repos)
Audience:
```
sts.amazonaws.com
```
(standard for AWS)
Provider thumbprint: GitHub's OIDC thumbprint (hardcoded, verified)

GitHub Actions Workflow Usage

permissions:
  id-token: write # Required for OIDC
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }} # e.g., arn:aws:iam::123:role/github-actions-infrastructure-admin-cd
          aws-region: sa-east-1

      - name: Deploy
        run: pulumi up --yes

Security Features

Repository-level access control: Only specified repos can assume roles
No long-lived credentials: Temporary STS tokens expire automatically
Wildcard branch support:
```
repo:org/repo:*
```
allows all refs (main, feature branches, tags)
Audit trail: CloudTrail logs all AssumeRoleWithWebIdentity calls

Adding New Roles

Edit
```
src/identity-provider/config.ts
```
Add new role to
```
roles
```
array
Run
```
bun run type-check
```
to verify types
Deploy with
```
pulumi up
```

Get role ARN:

pulumi stack output githubActionsRoleArns --json

Add ARN as GitHub secret:
```
AWS_ROLE_ARN
```
(or custom name)

Policy Support

AWS Managed Policies (auto-resolved):

```
"AdministratorAccess"
```
```
"AmazonEC2ContainerRegistryPowerUser"
```
Any AWS managed policy name

Custom Managed Policies (requires full ARN):

"arn:aws:iam::123456789012:policy/my-custom-policy"

The module automatically detects which format you're using by checking if the string starts with

"arn:"

Common Issues & Fixes

⚠️ Node.js Version Requirement (CI/CD)

CRITICAL: This project requires Node.js 23.6.0 or later to run Pulumi commands.

Problem: GitHub Actions default runners use Node.js 20.x, which causes Pulumi to fail.

Solution: Configure your CI/CD workflow to use Node.js 23+:

- name: Setup Node.js
  uses: actions/setup-node@v4
  with:
    node-version: "23.6.0"

Why: The project's TypeScript configuration and Pulumi operations depend on features only available in Node.js 23+. Installing Node.js via Homebrew in CI (which installs v24) works but is unnecessary if you configure the action runner correctly.

Import Issues

Always use
```
.ts
```
extensions in imports due to
```
"moduleResolution": "bundler"
```
Example:
```
import {something} from "./file.ts"
```
Path aliases:
```
import {ServiceName} from "@/iam"
```

Type Issues

Don't use
```
as const
```
for arrays that need to be mutable in Pulumi
Use regular arrays:
```
const EMAILS = ["[email protected]"]
```

Budget Filtering

Use
```
:
```
separator in cost filters:
```
"CreatedBy:username"
```
NOT
```
$
```
separator which doesn't work with AWS Budgets

Lambda Runtime

Use
```
aws.lambda.Runtime.NodeJS20dX
```
(not string constants)
AWS SDK v3 modules:
```
@aws-sdk/client-sns
```
,
```
@aws-sdk/client-iam
```

Group Management

Users are automatically added to groups based on
```
services
```
array
Per-user region restriction groups created when
```
regions
```
parameter is specified
Cost control policies are attached at group level
Region restrictions are per-user with custom IAM groups

Stack Outputs Available

User Credentials

pulumi stack output userCredentials --show-secrets --json

Returns:

{ username, accessKeyId, secretAccessKey }[]

Console Access

pulumi stack output consoleAccess --show-secrets --json

Returns:

{ username, temporaryPassword, passwordResetRequired, consoleLoginUrl }[]

Budget Summary

Available in

infra.ts

export for programmatic access.

GitHub OIDC Provider ARN

pulumi stack output githubOIDCProviderArn

Returns:

arn:aws:iam::ACCOUNT_ID:oidc-provider/token.actions.githubusercontent.com

GitHub Actions Role ARNs

pulumi stack output githubActionsRoleArns --json

Returns:

{ "role-id": "arn:aws:iam::ACCOUNT_ID:role/github-actions-role-id", ... }

KMS Key ARN

pulumi stack output kmsKeyArn

Returns:

arn:aws:kms:sa-east-1:ACCOUNT_ID:key/KEY_ID

Deployment Checklist

✅ Run
```
bun run type-check
```
- must pass
✅ Run
```
pulumi preview
```
- review resources
✅ Verify all team member emails are correct in
```
src/members.ts
```
✅ Check budget amounts and service arrays
✅ Deploy with
```
pulumi up
```
✅ Verify user credentials output
✅ Test group memberships in AWS Console

Current Status - Production Ready 🚀

Architecture: Advanced group-based IAM with per-user region restrictions
Resources: ~30+ AWS resources deployed (4 IAM restriction groups, 1 OIDC provider, 3 GitHub Actions roles, policies, user, dashboard, SNS)
Team Budget: $200/month total
Active Members: 1 user (maria-gonzalez) with admin + all restrictions + sa-east-1 region lock
GitHub OIDC: Configured for CI/CD automation with repository-level trust policies
Security: Enterprise-ready with comprehensive cost controls and per-user regional limitations
Regional Control: PER-USER - Each user can have custom allowed regions via
```
regions
```
parameter
Instance Types: Expanded ARM support (t3a, t4g) for cost optimization
Password Policy: User-friendly (8+ chars, mixed case + numbers, symbols optional)
Budget Framework: SNS topic ready, individual budgets disabled for iteration
Type Safety: ✅ All TypeScript errors resolved with strict bundler configuration
Cost Dashboard: CloudWatch dashboard for team cost monitoring
Access Provisioning: Both console and programmatic access supported

Next Iteration Features

Re-enable individual user budgets with proper Lambda deployment
Add CloudTrail integration for detailed usage tracking
Implement automated reporting via SNS/email
Add cost anomaly detection
Expand service coverage (add more AWS services)

Recent Major Improvements (Latest Commits) 🚀

LATEST: "feat: per-user region restrictions"

BREAKING: Replaced global region restrictions with per-user region control
NEW PARAMETER: Added
```
regions?: Region[]
```
to TeamMemberWithBudget interface
Per-User Groups: Each user with region restrictions gets their own IAM group
Flexible Control: Users can have custom allowed regions or no restrictions
Type-Safe: Uses
```
Region
```
type from constants for region validation

"feat: GitHub OIDC Identity Provider"

NEW MODULE: Complete GitHub Actions OIDC authentication system (
```
src/identity-provider/
```
)
Keyless CI/CD: Eliminates need for long-lived AWS access keys in GitHub secrets
Type-Safe: Full TypeScript with Pulumi Output types
Flexible: Supports AWS managed and custom managed policies
Repository-level trust: Fine-grained access control per repo
Production-ready: 4 files, ~140 LOC, full test coverage

dd54226: "feat: only sa-east-1 region allowed"

SUPERSEDED: Replaced by per-user region restrictions
Originally restricted ALL AWS services to sa-east-1 region only
Now users can have custom region configurations

e8d42d0: "feat: update instance types"

EXPANDED: Added ARM instance support (t3a, t4g) for better price/performance
Cost optimization through modern ARM-based instances
Maintained strict size limits (nano/micro/small only)

Productivity Tips for Claude Code Sessions 💡

Key Patterns to Follow

Always check current constants first:
```
src/constants.ts
```
has the latest restrictions
Regions are PER-USER: Each user can have custom
```
regions
```
parameter or no restrictions
Instance types are STRICT: Only t2/t3/t3a/t4g nano/micro/small allowed
Group membership is AUTOMATIC: Users join groups based on
```
services
```
array
Region groups are DYNAMIC: Created per-user when
```
regions
```
parameter is specified
Budget system is DISABLED: Focus on cost control through policies, not budgets

Quick Commands Reference

# Type check (always run first)
bun run type-check

# Preview changes
pulumi preview

# Deploy (with confirmation)
pulumi up

# Deploy (auto-confirm)
bun run deploy:like-a-boss

# Get credentials
pulumi stack output userCredentials --show-secrets --json

# Get console access
pulumi stack output consoleAccess --show-secrets --json

# Get KMS key ARN
pulumi stack output kmsKeyArn