Summary

• add Replicated Vendor OIDC provider for https://api.replicated.com/vendor
• add protected ReplicatedECRPullRole for Replicated proxy registry pulls
• attach the existing minimal GKE-ECR-Access-Policy, matching the current replicated IAM user's ECR permissions
• set aws-production replicatedTeamSubject from the Replicated Vendor API teamId
• keep the existing replicated IAM user in place until the new role is tested in the Replicated Vendor Portal

Applied in AWS

• Account: 008971668139 / srujan@composio-production
• OIDC provider is present:
  • ARN: arn:aws:iam::008971668139:oidc-provider/api.replicated.com/vendor
  • URL: api.replicated.com/vendor
  • Client ID: sts.amazonaws.com
  • Created: 2026-06-11T05:13:53Z
  • Tags: ManagedBy=Pulumi, Vendor=Replicated
• Role is present:
  • ARN: arn:aws:iam::008971668139:role/ReplicatedECRPullRole
  • Created: 2026-06-11T05:14:09Z
  • Trust principal: arn:aws:iam::008971668139:oidc-provider/api.replicated.com/vendor
  • Trust action: sts:AssumeRoleWithWebIdentity
  • Trust conditions:
    • api.replicated.com/vendor:aud = sts.amazonaws.com
    • api.replicated.com/vendor:sub = 34mwmnOLsaJ0cfUyoKQ2CA6vijb
  • Attached policy: arn:aws:iam::008971668139:policy/GKE-ECR-Access-Policy
• Existing IAM user remains present:
  • ARN: arn:aws:iam::008971668139:user/replicated
  • Created: 2025-12-12T12:12:28Z

CloudTrail

• CreateOpenIDConnectProvider at 2026-06-11T05:13:53Z
• CreateRole for ReplicatedECRPullRole at 2026-06-11T05:14:09Z
• AttachRolePolicy for GKE-ECR-Access-Policy at 2026-06-11T05:14:30Z
• UpdateAssumeRolePolicy for ReplicatedECRPullRole at 2026-06-11T05:39:15Z
• All write events were made by the AWS SSO assumed-role session:
  • arn:aws:sts::008971668139:assumed-role/AWSReservedSSO_AdministratorAccess_e68e7f118d976862/srujan@composio.dev
  • Pulumi AWS provider user agent on macOS

Validation

• Replicated CLI/API confirmed app composio-rodent teamId is 34mwmnOLsaJ0cfUyoKQ2CA6vijb
• ./node_modules/.bin/tsc -p stacks/aws-production/tsconfig.json --noEmit passed
• pulumi up --config aws:profile=srujan@composio-production created the OIDC provider, role, and policy attachment
• Follow-up pulumi up updated only ReplicatedECRPullRole assumeRolePolicy subject
• Live AWS IAM checks on 2026-06-12 confirmed the OIDC provider, role trust policy, policy attachment, and existing replicated IAM user