unoverse 0.1.126 → 0.1.127

package/operator/infra/aws/main.tf

@@ -271,6 +271,28 @@ resource "aws_instance" "app" {
     volume_type = "gp3"
   }
 
+  # IMDSv2 REQUIRED, and this is not optional in a governed account.
+  #
+  # AWS's own recommended guardrail denies ec2:RunInstances unless the launch enforces
+  # IMDSv2, and organisations apply it as a Service Control Policy. Without this block the
+  # AWS default is `optional`, the condition is not met, and the deny fires:
+  #
+  #   UnauthorizedOperation ... ec2:RunInstances ... with an explicit deny in a service
+  #   control policy
+  #
+  # That error names no condition, so it reads as "EC2 is banned here" and sends you to your
+  # cloud team for a policy change you do not need. The condition is visible only by
+  # decoding the failure message (`aws sts decode-authorization-message`), which showed
+  # `ec2:MetadataHttpTokens = required`. Proved by dry run 2026-08-06: identical launch
+  # refused without this block, accepted with it.
+  #
+  # It is the right default everywhere regardless. IMDSv1 lets any process that can forge a
+  # simple GET read the instance's credentials; IMDSv2 requires a signed token first.
+  metadata_options {
+    http_endpoint = "enabled"
+    http_tokens   = "required"
+  }
+
   tags = { Name = "${var.name}-app" }
 }
 
@@ -589,10 +611,25 @@ resource "aws_iam_user_policy" "bedrock" {
     Version = "2012-10-17"
     Statement = [{
       Effect = "Allow"
+      # WIDE ON RUNTIME, silent on spending.
+      #
+      # Three named Invoke actions dated fast. `Converse` is the current unified API and the
+      # Bedrock nodes already call it; `ApplyGuardrail` is a separate action the guardrail
+      # node needs; knowledge bases add `Retrieve`. Each arrival meant editing this list,
+      # re-applying, and in a managed account asking an administrator again.
+      #
+      # NOT `bedrock:*`. That includes CreateProvisionedModelThroughput, which commits money.
+      # Everything below is invoke-and-read: it cannot buy capacity, and it cannot create or
+      # delete a model or a guardrail.
+      #
+      # Model access is still granted per model in the Bedrock console. No policy grants it.
       Action = [
-        "bedrock:InvokeModel",
-        "bedrock:InvokeModelWithResponseStream",
-        "bedrock:InvokeModelWithBidirectionalStream",
+        "bedrock:InvokeModel*",
+        "bedrock:Converse*",
+        "bedrock:ApplyGuardrail",
+        "bedrock:Retrieve*",
+        "bedrock:List*",
+        "bedrock:Get*",
       ]
       Resource = "*"
     }]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.126",
+  "version": "0.1.127",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",