Gate
llms.txtlists every page for an agent
Optional: hand this page to your coding agentThe steps work by hand too.Show the whole prompt
Follow https://intentius.io/choudoufu/aws/gate/. Draft an IAM policy scoping one role to this estate and show it to me.
Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.The create call writes the tag, so a role can be scoped by it.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "MutateOnlyThisEstate",
"Effect": "Allow",
"Action": ["ec2:CreateTags", "ec2:DeleteTags", "ec2:TerminateInstances"],
"Resource": "*",
"Condition": {
"StringEquals": {"aws:ResourceTag/tofu-estate": "prod-networking"},
"StringEqualsIfExists": {"aws:RequestTag/tofu-estate": "prod-networking"}
}
},
{
"Sid": "CreateOnlyIntoThisEstate",
"Effect": "Allow",
"Action": ["ec2:RunInstances"],
"Resource": "*",
"Condition": {
"StringEquals": {"aws:RequestTag/tofu-estate": "prod-networking"}
}
},
{
"Sid": "TagOnlyAsPartOfThatCreate",
"Effect": "Allow",
"Action": ["ec2:CreateTags"],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestTag/tofu-estate": "prod-networking",
"ec2:CreateAction": "RunInstances"
}
}
}
]
}What that buys
Section titled “What that buys”Handing an estate over moves this policy to the new role, and plain aws calls meet the same fence.
Guarding the marker
Section titled “Guarding the marker”An SCP that denies the untag actions keeps the tag on resources in member accounts (GOVERNANCE.md).