Cloud & cross-account

The CLI is standalone by default. Opt into Laminar Cloud for teams and managed env, and use assume-role to deploy into other AWS accounts.

Laminar Cloud

Cloud adds a managed control plane — teams, roles, dashboards, and synced env/secrets — on top of your AWS. It never runs your compute; see pricing.

laminar login            # store a token in ~/.laminar (chmod 600)
laminar whoami           # show identity + API URL
laminar link             # connect this project (flips it to cloud mode)
laminar deploy prod      # now also pulls cloud-managed env
laminar mode local       # switch back to standalone anytime

API URL defaults to https://api.laminar.rocks/api/v1 (LAMINAR_API_URL to override / self-host). Mode precedence: LAMINAR_MODE → project state → default (local).

Managing cloud resources

laminar projects list
laminar projects create my-api --runtime python --region us-east-1
laminar orgs current
laminar orgs switch <org-id>
laminar orgs members

Cross-account deploys

Deploy into a different AWS account by assuming a role there (STS + ExternalId). The target account creates the role from the CloudFormation template in the Infrastructure repo; you then point the CLI at it.

laminar deploy prod \
  --assume-role-arn arn:aws:iam::<target>:role/LaminarDeploymentRole \
  --external-id <id>

…or set it in laminar.yml:

aws:
  assume_role_arn: arn:aws:iam::<target>:role/LaminarDeploymentRole
  external_id: <secret>

The ExternalId guards against the confused-deputy problem and is required by the role’s trust policy. Credentials are temporary (assumed per run).