IAM roles reference

The StratoNext onboarding template creates up to five IAM roles in your account. All of them are trusted only by the StratoNext platform account. Agents never assume roles in your account directly.

The credential broker model

Agents never hold long-lived cloud credentials. When an agent needs to perform an AWS operation:

1. The agent pauses its task and emits a credential request.
2. The request enters the approval flow governed by your automation policy.
3. On approval, the StratoNext credential broker assumes the appropriate role in your account and mints a short-lived credential scoped to that specific task.
4. The credential is held in memory only for the duration of the operation and never persisted.

Setting an ExternalId when deploying the template adds a condition to the operations roles’ trust policies, protecting against confused-deputy attacks.

Roles

StratoNextConnectionRole

Always created. Used by the platform to validate the connection and keep your environment in sync: it can describe CloudFormation stacks and read templates so StratoNext can discover and map your deployed resources.

StratoNextOperationsRole

Created when EnableAgentAccess is true. The baseline access agents work with. The credential broker assumes this role and hands short-lived credentials to the agent. The agent never assumes it directly. The default policy is read-only: describing EC2, S3, Lambda, DynamoDB, and RDS resources, reading CloudWatch metrics, and querying CloudWatch Logs.

Customize this role’s policy in your account to widen or narrow what agents can do by default.

StratoNextOperationsMaxRole

Created when EnableAgentAccess is true. The escalation ceiling. When an elevated action is approved, the credential broker assumes this role and scopes the session down to the approved action and resource set via an STS session policy. An approval can never grant more than this role allows.

Tune its policy to your risk tolerance, and keep it a sane ceiling, never AdministratorAccess.

StratoNextRuntimeRole

Created when EnableAgentDeployment is true. The identity a StratoNext agent runs with when deployed inside your own AWS account on Amazon Bedrock AgentCore. It can invoke Bedrock models, write its own logs and telemetry, and store its tokens in a scoped SSM parameter path. It has no sts:AssumeRole permission. Even in-account agents get their operations credentials from the credential broker, never by assuming roles themselves.

StratoNextDeploymentRole

Created when EnableAgentDeployment is true. Used by the platform to deploy and manage agent runtimes on Bedrock AgentCore in your account: creating and updating agent runtimes, managing their endpoints, and passing the runtime role. Deletion permissions are scoped so it can only remove workload identities that StratoNext itself created.

Revoking access

Delete the CloudFormation stack to remove all roles and revoke StratoNext’s access to your account immediately. Because all access is short-lived STS sessions, there are no keys to rotate.