edgegate_setup_byo_storage
Set up BYO S3 storage by creating a pending grant with EdgeGate and obtaining the exact AWS CLI commands to create the IAM role. Removes guesswork from trust policies and role names.
Instructions
Enterprise only. Zero-friction BYO storage setup — creates a pending grant with EdgeGate (returns the External ID) and returns the exact AWS CLI commands the agent should run to create the IAM role in the customer's AWS account. Pair with edgegate_attach_byo_role to finalize. Prefer this over edgegate_register_byo_bucket for new setups — the agent doesn't have to figure out the trust policy or guess at role names. Requires owner role. 402 from non-Enterprise workspaces; if a non-pending grant exists, instructs the agent to disconnect first.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| bucket | Yes | S3 bucket name (not the URI) you want EdgeGate to read model bytes from. | |
| region | Yes | AWS region the bucket lives in, e.g. us-east-1. | |
| kms_key_id | No | Optional KMS key ARN if the bucket uses SSE-KMS with a customer-managed key. The IAM role will be granted kms:Decrypt on this key. Leave unset for SSE-S3 or SSE-KMS with the AWS-managed key. | |
| workspace_id | Yes | Workspace ID. Must be Enterprise-tier with BYO storage enabled. | |
| role_name_override | No | Optional override for the IAM role name. Default mirrors the CloudFormation path: edgegate-byo-read-<first-8-chars-of-external-id>. |