descriptionstring required
aws_account_idstring required
assume_role_arnstring required
default_regionstring required
created_bystring required
created_atstring date-time required
updated_atstring date-time required
external_id_setboolean required
Whether an assume-role external id is configured; the value itself never leaves the server.
vend_role_arnstring required
The fleet-vend role a cross-account vend into this account assumes. Published to SSM by landing-zone; the vend does not create it. Empty means ungated (same-account vending). Requires both permissions boundaries — an order carrying the role without them is refused.
data_kms_key_arnstring required
Customer-managed KMS key for this account's data at rest. Published to SSM by landing-zone. Empty means the XRD default.
cluster_permissions_boundary_arnstring required
IAM permissions boundary capping the roles a cross-account vend mints for the cluster. Published to SSM at /eks-fleet/<environment>/fleet-vend/vend_permissions_boundary_arn.
operator_permissions_boundary_arnstring required
Permissions boundary capping the roles the agent-platform operator mints on this account. Same requirement and SSM source as cluster_permissions_boundary_arn.