Per-customer ExternalId
AWS deployments now use a per-customer ExternalId on their management roles. Alien generates one for each deployment group, and the portal fills it in. To require it on CloudFormation packages:
alien projects packages update --file - <<'JSON'
{ "cloudformation": { "requireManagementExternalId": true } }
JSONAlien's managing role serves many customers. The ExternalId makes sure one customer's registration can't name another customer's role, the confused-deputy problem. Every AssumeRole call sends it.
Require AWS External ID is on by default for new projects, under
Settings → Artifacts → CloudFormation. In Terraform, it's the
management_external_id variable.
- Google Cloud: initial setup creates workload identity federation in the customer's own project, and management credentials renew through it
- One role per deployment: each deployment is reached through the managing role its stack trusts
- Neutral names: resources Alien creates at runtime carry a neutral prefix, not Alien's name