OptionalaccountAurora cluster resource ID (cluster-XXXXXXXX). Exported by
cfx-db as auroraClusterResourceId. Used to scope
rds-db:connect to this cluster + username.
Environment tag (e.g. dev, prod). Also embedded in the role name.
OptionalgithubOrg the repo lives under, in the OIDC subject claim. Defaults to
CFXLabsInc.
GitHub repo (e.g. cfx-platform) whose Actions OIDC identity is
trusted to assume the CI role. Assumed to live under the CFXLabsInc
org.
OptionalpermissionsOptional permissions boundary. Defaults to cfx-workload-boundary.
OptionalregionDefaults to the current provider region.
OptionalsubjectRestricts which workflow runs can assume the role, via the
token.actions.githubusercontent.com:sub claim. Defaults to * (any
branch / env). Tighten to e.g. environment:prod or ref:refs/heads/main
for production deploys.
Postgres username that CI will authenticate as via IAM. Typically the
<db>_ci role created by cfx-db and exported as
<db>CiUsername. The component does not create the Postgres role — only
the AWS-side IAM role + rds-db:connect inline policy that lets CI
generate auth tokens for this user.
Defaults to caller identity.