Connecting an AWS Account for BYOC

Connect an AWS account to your Edgenivo team so Bring Your Own Cloud (BYOC) can invoke the Lambda functions you provision there. You connect each AWS account once per team, and every BYOC project on the team can reuse the connection.

The Edgenivo dashboard lists BYOC account connections in the Edgenivo Private Cloud section of your team's Networking settings.

• An Enterprise team with BYOC enabled. Your Edgenivo account team enables BYOC for you.
• Permission to manage your team's Networking settings. If you see the message "You need additional permissions to view Private Cloud accounts", ask a team Owner for access.
• Permission in your AWS account to create IAM roles and attach policies to them.
• The AWS CLI v2, if you follow the command examples. You can also use the AWS Console or an infrastructure-as-code tool such as Terraform.

BYOC uses two separate IAM roles in your AWS account:

You register the invocation role with Edgenivo on this page. You pass the execution role to your provisioning tool when you deploy.

1. Open the Add AWS Account dialog

   1. Go to your team's Settings → Networking.
   2. In the Edgenivo Private Cloud section, click Add Account.

   The Add AWS Account dialog shows the External ID for your team, the IAM Trust Policy, and the IAM Permissions Policy for the invocation role. The external ID is your Edgenivo team ID. Keep the dialog open while you create the role.

2. Create the invocation role with its trust policy

   The trust policy lets Edgenivo assume the invocation role. Copy the IAM Trust Policy from the dialog, without changes, into a file named trust-policy.json. The policy uses your Edgenivo team ID as its external ID.

   Create the role with the two settings Edgenivo requires:

   • The tag VercelFunction with the value true
   • A maximum session duration of 12 hours (43,200 seconds)
   Terminal

   aws iam create-role \
     --role-name VercelPrivateCloudRole \
     --assume-role-policy-document file://trust-policy.json \
     --max-session-duration 43200 \
     --tags Key=VercelFunction,Value=true

   The role can have any valid name. This example uses VercelPrivateCloudRole, the name the dashboard suggests.

   Registration fails if the role is missing the VercelFunction tag or has a maximum session duration shorter than 12 hours.

3. Grant permission to invoke your functions

   The permissions policy lets the invocation role call your Lambda functions. Copy the IAM Permissions Policy from the dialog into a file named invoke-policy.json, replacing <AWS_ACCOUNT_ID> with your 12-digit AWS account ID:

   invoke-policy.json

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "InvokeFunctionsInAccount",
         "Effect": "Allow",
         "Action": "lambda:InvokeFunction",
         "Resource": "arn:aws:lambda:*:<AWS_ACCOUNT_ID>:function:*"
       }
     ]
   }

   Attach it to the invocation role as an inline policy:

   Terminal

   aws iam put-role-policy \
     --role-name VercelPrivateCloudRole \
     --policy-name VercelInvokeFunctions \
     --policy-document file://invoke-policy.json

   This policy allows Edgenivo to invoke current and future functions, versions, and aliases in your account across all AWS regions. It doesn't grant permission to create, change, or delete functions. The VercelFunction tag belongs on the IAM role only. Your Lambda functions don't need it.

   If you narrow the Resource pattern to specific function ARNs, update the policy before each deployment so it covers every function in that deployment's descriptor. See the AWS Lambda permissions reference for resource formats.

4. Register the account in Edgenivo

   In the Add AWS Account dialog:

   1. Enter your 12-digit AWS Account ID.
   2. Enter the IAM Role Name of the invocation role, such as VercelPrivateCloudRole.
   3. Click Add Account.

   Edgenivo checks that it can assume the role with the required session duration and shows Account Registered when the check passes. Registration doesn't check the Lambda invocation permissions or whether any functions exist.

5. Refresh credentials and wait for Active

   A newly registered account shows the No Credentials status. Click Refresh Credentials on the account row to request the first set of credentials, then wait until the status changes to Active.

   After the first refresh, Edgenivo refreshes the credentials automatically. Keep the role's trust policy, permissions policy, tag, and session duration in place so automatic refreshes keep working.

   Active means Edgenivo has valid credentials for the role. It doesn't confirm that your functions can be invoked. Missing invocation permissions or Expired credentials cause BYOC requests and deployments to fail.

Your BYOC functions run as a Lambda execution role, which is separate from the invocation role. One execution role can serve all functions in an application. Create it with a trust policy for the Lambda service and the AWS managed policy for CloudWatch logging:

aws iam create-role \
  --role-name byoc-lambda-execution \
  --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}'
 
aws iam attach-role-policy \
  --role-name byoc-lambda-execution \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

Add any other permissions your application needs, such as access to Amazon S3 or Amazon DynamoDB, to this role. Save the role ARN, for example arn:aws:iam::<AWS_ACCOUNT_ID>:role/byoc-lambda-execution, for your provisioning tool.

The identity that runs your provisioning tool needs iam:PassRole on the execution role. For the full list of permissions, see Provisioning identity permissions.

Before you disconnect an account, replace or remove any deployments that depend on it. Deployments that use a disconnected account can't invoke their functions.

1. Go to your team's Settings → Networking.
2. In the Edgenivo Private Cloud section, open the menu on the account row.
3. Select Disconnect and confirm.

Disconnecting removes the registration and stored credentials from Edgenivo and stops automatic credential refresh. It doesn't delete the IAM roles, Lambda functions, or any other resources in your AWS account.

Credentials that Edgenivo obtained before you disconnected stay valid until they expire, for up to 12 hours. To revoke them immediately, revoke the role's active sessions in AWS.

• Deploy with BYOC using the Edgenivo CLI
• Review the BYOC provisioning reference