Description
Developer containers cannot reach IMDS (only the gateway can), and Codex and pi cannot use the Claude apps gateway, so they need their own Bedrock credential. The maintainer chose a scoped IAM principal in the agent-host secret, with no budgets, alarms or residency constraint. Codex uses OpenAI models on bedrock-mantle (action bedrock-mantle:CreateInference, possibly US-region only, which is acceptable); pi uses the existing per-team application inference profiles (data.aws_iam_policy_document.bedrock_invoke in terraform/aws-bedrock.tf). See doc-0002.
Acceptance Criteria
- #1 A new IAM principal allows only the Bedrock models, profiles and regions Codex and pi use, and nothing else
- #2 Its credential reaches the agent-host secret under keys documented in SEAM.md and is rendered as 0400 files owned by the developer uid, never as compose environment
- #3 The credential type (IAM access key or Bedrock service-specific credential) is chosen on evidence of Terraform support, and rotation is documented in docs/security.md
Definition of Done
- #1 just check
Implementation Plan
Use separate Terraform-managed IAM access-key principals per non-Claude agent type. Pi only accesses selected team profiles and their conditioned backing models; Codex only the selected Mantle model and region. Mount credentials as uid-owned 0400 files and document rotation; verify live with the actual clients.
Implementation Notes
Live scoped-key checks passed: both new principals are denied S3 ListBuckets; pi is denied direct foundation-model Converse while allowed through its selected application profile; Codex is denied a different Mantle model (HTTP403 access_denied) while its exact Luna model works. This is actual credential authorization evidence, not only policy simulation.
Local renderer tests prove credential file mode and per-agent isolation; live file-mounted credentials ran both actual CLIs and negative calls. Credential choice and rotation documented. Await exact repaired CI result before terminal reconciliation.
Final Summary
Separate least-privilege Codex/pi IAM principals and file-only credentials implemented and applied for spikes. Actual CLI positive calls and negative S3/direct-model/different-model calls verified scope; renderer tests verify secret separation and modes. Rotation documented. Full local gate and pre-land reviews passed.