# Shared AWS CLI profiles for CFX. `sh scripts/setup.sh` copies this to ~/.aws/config when none
# exists; otherwise merge the sections you are missing by hand. It holds no credentials.
#
# Every profile shares the one `cfx` sso-session, so a single `aws sso login --sso-session cfx`
# signs in all of them, and the CLI refreshes role credentials on its own until the IAM Identity
# Center session ends. A profile that repeats `sso_start_url` itself is the legacy, non-refreshing
# form; do not add one.
#
# A profile whose permission set you are not assigned fails with `No access`. That and the
# account each profile lands in are covered in docs/runbooks/aws-access-denied.md.

[sso-session cfx]
sso_start_url = https://d-9267677086.awsapps.com/start
sso_region = us-west-2
sso_registration_scopes = sso:account:access

# Settings here apply to `[default]` only, not to the named profiles below.
# The AWS CLI reads a trailing `# ...` as part of the value, so comments sit on their own lines.
[default]
region = us-west-2
output = json
# Print output straight to the terminal instead of through `less`.
cli_pager =
# Prompt interactively for the rest of an incomplete command.
cli_auto_prompt = on-partial
# Record commands for `aws history list` / `aws history show`.
cli_history = enabled
# Back off and retry on throttling.
retry_mode = adaptive
max_attempts = 5
# `lambda invoke --payload '{...}'` takes raw JSON instead of base64.
cli_binary_format = raw-in-base64-out

# workload-nonprod-dev-001

[profile workload-dev]
sso_session = cfx
sso_account_id = 206248878611
sso_role_name = CFXNonProdAdministrator
region = us-west-2
output = json

# workload-prod-001

[profile workload-prod]
sso_session = cfx
sso_account_id = 372806568664
sso_role_name = CFXProdAdministrator
region = us-west-2
output = json

# Organization and platform accounts

[profile cfx-management]
sso_session = cfx
sso_account_id = 801923637589
sso_role_name = AWSAdministratorAccess
region = us-west-2
output = json

[profile cfx-aft-management]
sso_session = cfx
sso_account_id = 044105603745
sso_role_name = CFXAftManagementAdministrator
region = us-west-2
output = json

[profile cfx-audit]
sso_session = cfx
sso_account_id = 876166168768
sso_role_name = AWSAdministratorAccess
region = us-west-2
output = json

[profile cfx-log-archive]
sso_session = cfx
sso_account_id = 662878621582
sso_role_name = AWSAdministratorAccess
region = us-west-2
output = json

[profile network-prod]
sso_session = cfx
sso_account_id = 236149946609
sso_role_name = AWSAdministratorAccess
region = us-west-2
output = json

# The agent harness and llm-proxy (packages/agent-harness)

[profile agents-prod]
sso_session = cfx
sso_account_id = 156618920242
sso_role_name = AWSAdministratorAccess
region = us-west-2
output = json

# Every prod developer: reads only their own llm-proxy virtual key (packages/llm-proxy-agents/README.md)

[profile llm-proxy-key]
sso_session = cfx
sso_account_id = 156618920242
sso_role_name = CFXLlmProxyKeyReader
region = us-west-2
output = json