源文件
aws/iam/exec-role.yaml

离线配置。未部署到任何云账号。
# SECONDARY — AWS parallel; GCP is the primary narrative of this demo.
kind: AwsIamFragment
secondary: true
role_name: insights-api-exec
purpose: runtime
description: Execution role. Logs to one log group and reads one Secrets Manager ARN.
bindings:
  - member: arn:aws:iam::000000000000:role/insights-api-exec
    role: logs:PutLogEvents
    resource: arn:aws:logs:us-east-1:000000000000:log-group:/thistle/insights-api:*
    purpose: runtime
    sa: insights-api-exec
  - member: arn:aws:iam::000000000000:role/insights-api-exec
    role: secretsmanager:GetSecretValue
    resource: arn:aws:secretsmanager:us-east-1:000000000000:secret:insights-api-signing-key-placeholder
    purpose: runtime
    sa: insights-api-exec
  - member: arn:aws:iam::000000000000:role/insights-api-exec
    role: sqs:SendMessage
    resource: arn:aws:sqs:us-east-1:000000000000:insights-api-secondary-dlq
    purpose: runtime
    sa: insights-api-exec