unoverse 0.1.126 → 0.1.128

package/operator/infra/aws/main.tf

@@ -271,6 +271,28 @@ resource "aws_instance" "app" {
     volume_type = "gp3"
   }
 
+  # IMDSv2 REQUIRED, and this is not optional in a governed account.
+  #
+  # AWS's own recommended guardrail denies ec2:RunInstances unless the launch enforces
+  # IMDSv2, and organisations apply it as a Service Control Policy. Without this block the
+  # AWS default is `optional`, the condition is not met, and the deny fires:
+  #
+  #   UnauthorizedOperation ... ec2:RunInstances ... with an explicit deny in a service
+  #   control policy
+  #
+  # That error names no condition, so it reads as "EC2 is banned here" and sends you to your
+  # cloud team for a policy change you do not need. The condition is visible only by
+  # decoding the failure message (`aws sts decode-authorization-message`), which showed
+  # `ec2:MetadataHttpTokens = required`. Proved by dry run 2026-08-06: identical launch
+  # refused without this block, accepted with it.
+  #
+  # It is the right default everywhere regardless. IMDSv1 lets any process that can forge a
+  # simple GET read the instance's credentials; IMDSv2 requires a signed token first.
+  metadata_options {
+    http_endpoint = "enabled"
+    http_tokens   = "required"
+  }
+
   tags = { Name = "${var.name}-app" }
 }
 
@@ -578,21 +600,50 @@ resource "aws_cognito_user_pool_domain" "domain" {
 # NOTE: the secret lands in Terraform state — acceptable at POC, noted in the doc.
 # Model ACCESS is enabled in the console per model/region, outside Terraform.
 
+# OPTIONAL, because it is the only thing here that needs IAM write and nothing reads it.
+#
+# The platform never uses these keys. They exist as OUTPUTS, for a developer to paste into
+# the Credentials UI, exactly as they would an OpenAI key. So a universe that does not use
+# the Bedrock nodes was minting a permanent access key for nobody, and paying for it in the
+# one place that matters: `iam:CreateUser` is excluded from AWS's PowerUserAccess policy, so
+# in any managed account this single resource turns a working deploy into a request to
+# somebody's cloud team.
+#
+# DEFAULT TRUE, deliberately. Flipping it to false would DESTROY the user and key in every
+# universe that already has one, and silently break Bedrock for anyone who had pasted those
+# keys into a credential. Set it false where IAM write is not delegated.
 resource "aws_iam_user" "bedrock" {
-  name = "${var.name}-bedrock-invoke"
+  count = var.bedrock_credentials ? 1 : 0
+  name  = "${var.name}-bedrock-invoke"
 }
 
 resource "aws_iam_user_policy" "bedrock" {
-  name = "bedrock-invoke-only"
-  user = aws_iam_user.bedrock.name
+  count = var.bedrock_credentials ? 1 : 0
+  name  = "bedrock-invoke-only"
+  user  = aws_iam_user.bedrock[0].name
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [{
       Effect = "Allow"
+      # WIDE ON RUNTIME, silent on spending.
+      #
+      # Three named Invoke actions dated fast. `Converse` is the current unified API and the
+      # Bedrock nodes already call it; `ApplyGuardrail` is a separate action the guardrail
+      # node needs; knowledge bases add `Retrieve`. Each arrival meant editing this list,
+      # re-applying, and in a managed account asking an administrator again.
+      #
+      # NOT `bedrock:*`. That includes CreateProvisionedModelThroughput, which commits money.
+      # Everything below is invoke-and-read: it cannot buy capacity, and it cannot create or
+      # delete a model or a guardrail.
+      #
+      # Model access is still granted per model in the Bedrock console. No policy grants it.
       Action = [
-        "bedrock:InvokeModel",
-        "bedrock:InvokeModelWithResponseStream",
-        "bedrock:InvokeModelWithBidirectionalStream",
+        "bedrock:InvokeModel*",
+        "bedrock:Converse*",
+        "bedrock:ApplyGuardrail",
+        "bedrock:Retrieve*",
+        "bedrock:List*",
+        "bedrock:Get*",
       ]
       Resource = "*"
     }]
@@ -600,7 +651,8 @@ resource "aws_iam_user_policy" "bedrock" {
 }
 
 resource "aws_iam_access_key" "bedrock" {
-  user = aws_iam_user.bedrock.name
+  count = var.bedrock_credentials ? 1 : 0
+  user  = aws_iam_user.bedrock[0].name
 }
 
 # ── Native ingress (2026-07-29): ONE ALB, host-routed — the thing DO's LB can't

package/operator/infra/aws/outputs.tf

@@ -71,12 +71,12 @@ output "cognito_hosted_ui" {
 
 output "bedrock_access_key_id" {
   description = "Store as a platform awsCredential (accessKeyId) for the Bedrock/Nova nodes"
-  value       = aws_iam_access_key.bedrock.id
+  value       = one(aws_iam_access_key.bedrock[*].id)
 }
 
 output "bedrock_secret_access_key" {
   description = "Store as a platform awsCredential (secretAccessKey)"
-  value       = aws_iam_access_key.bedrock.secret
+  value       = one(aws_iam_access_key.bedrock[*].secret)
   sensitive   = true
 }
 

package/operator/infra/aws/variables.tf

@@ -117,3 +117,16 @@ variable "operator_public_key" {
   type        = string
   default     = ""
 }
+
+# Whether to create the Bedrock IAM user and access key (main.tf, "Bedrock").
+#
+# TRUE preserves what every existing universe already has. FALSE skips the only resource
+# here that needs IAM write, which is what makes a deploy possible in an account where
+# `iam:CreateUser` is not delegated. Nothing in the platform reads the keys: they are
+# outputs, for pasting into a credential, so switching this off costs a manual step and
+# nothing else.
+variable "bedrock_credentials" {
+  type        = bool
+  default     = true
+  description = "Create an IAM user and access key for the Bedrock nodes. Set false where IAM write is not delegated."
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.126",
+  "version": "0.1.128",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",