zooqueenandHanzo Dev f3554b2490 Egress carries AWS: it signs each request with SigV4 for an endpoint its -aws list admits, from a role it assumes with its own IAM identity or a sealed key pair, and carries non-JSON bodies and answers as bytes with their Content-Type. ...

The platform's account is read from cloud/aws/<label>/credential in egress's KMS org. A role descriptor there may be in the clear because it holds no secret; a key pair must be sealed. A caller cannot enrol a role, and a role at a caller's own path is refused. A JSON call and a JSON answer are unchanged, and a call with no body no longer sends the literal null.

Co-authored-by: Hanzo Dev <[email protected]>

2026-09-23 17:47:30 -07:00

..

go.mod

spend: carry the request context over ZAP

2026-09-17 23:58:44 -07:00

go.sum

spend: carry the request context over ZAP

2026-09-17 23:58:44 -07:00

session.go

Broker a database session, on the credential nobody holds

2026-09-04 14:38:29 -07:00

spend_test.go

Egress carries AWS: it signs each request with SigV4 for an endpoint its -aws list admits, from a role it assumes with its own IAM identity or a sealed key pair, and carries non-JSON bodies and answers as bytes with their Content-Type.

2026-09-23 17:47:30 -07:00

spend.go

Egress carries AWS: it signs each request with SigV4 for an endpoint its -aws list admits, from a role it assumes with its own IAM identity or a sealed key pair, and carries non-JSON bodies and answers as bytes with their Content-Type.

2026-09-23 17:47:30 -07:00