Cloud providers
Configure AWS Bedrock for Floprints — region, encrypted keys, execution role, gateway ARN, and nightly model catalog sync.
Supported providers
Floprints currently supports AWS Bedrock as the cloud provider. Each blueprint is bound to exactly one provider for its lifetime.
Per-provider settings
Configure in Settings → Providers:
| Field | Purpose |
|---|---|
| Region | AWS region for Bedrock and AgentCore |
| Access keys | Envelope-encrypted at rest; used for deploy and execute |
| Execution role ARN | IAM role AgentCore assumes for harness execution |
| Runtime container URI | AgentCore runtime image |
| Gateway ARN | AgentCore Gateway for gateway-backed tools |
Model catalog
A nightly model-sync scheduler refreshes the Bedrock model catalog. The composer and plan validation use this catalog for model selection.
Sync status and manual refresh are available in provider settings.
Group-scoped access
Provider access is group-scoped and fail-closed:
- A member can use a provider only if one of their groups is granted it
- Admins bypass the group mapping
- Without access, compose/deploy/execute return forbidden
Assign providers to groups in Admin → Groups.
Secrets handling
All provider credentials go through the SecretStore interface with per-row envelope encryption (DEK wrapped by KEK). Rotating KEK_PRIMARY only rewraps DEKs — no credential plaintext in the database.