edgegate_register_byo_bucket
Register an existing IAM role and S3 bucket as a BYO storage grant. Returns the External ID to add to your role's trust policy so EdgeGate can access your bucket.
Instructions
Enterprise only. Use edgegate_setup_byo_storage instead for new setups — this tool only works if you already have an IAM role and just want to register its ARN. Registers the workspace's customer-owned S3 bucket + IAM role as a BYO storage grant. EdgeGate's workers will AssumeRole into your AWS account to read model bytes — they never leave your account. Returns the External ID you must add to your role's trust policy. Requires owner role. 402 from non-Enterprise workspaces; 409 if a grant already exists.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| bucket | Yes | S3 bucket name (not the URI — just the bucket name). | |
| region | Yes | AWS region the bucket lives in, e.g. us-east-1. | |
| role_arn | Yes | ARN of the IAM role EdgeGate's workers will assume to read your bucket. Created by the EdgeGate CloudFormation launch stack (or your equivalent Terraform module). Format: arn:aws:iam::<account-id>:role/<name>. | |
| kms_key_id | No | Optional KMS key ARN if the bucket uses SSE-KMS. The IAM role must have kms:Decrypt on this key. | |
| workspace_id | Yes |