AWS account connection

Every workload runs in your connected AWS account. The web, CLI, and CI/CD all use the hosted control plane and the same project state.

One control plane

Laminar manages organizations, authorization, deployment state, dashboards, and synchronized configuration. Application compute and managed resources stay in the AWS account you connect; see pricing.

laminar login --email you@example.com --password '...'
laminar whoami
laminar link --project-id <project-id>
laminar deploy production

API URL defaults to https://api.laminar.rocks/api/v1 (LAMINAR_API_URL can override it for development). The CLI stores a backend-issued CLI token with user-only file permissions.

Managing shared resources

laminar projects list
laminar projects create my-api --runtime python --region us-east-1
laminar orgs current
laminar orgs switch <org-id>
laminar orgs members

Connected AWS role

An organization connects an AWS role that the control plane can assume with STS and an external ID. Deployments from the web, CLI, and CI/CD all use that backend-managed connection.

AWS role ARN: arn:aws:iam::<account-id>:role/<deployment-role>
External ID: generated for the organization
Region: the project's deployment region

The external ID guards against the confused-deputy problem and is required by the role trust policy. AWS credentials are temporary and assumed for platform operations.