fused-infralisted

Reference for the infrastructure managed by fused — what resources exist, why each one is needed, and when they are created, updated, or deleted. Covers the AWS backend (IAM, Lambda, ECR, S3) and the local backend (data directories + venvs, see "Local backend infra"). Use when helping users understand, provision, or troubleshoot the resources that back an fused environment.
fusedio/skills · ★ 5 · DevOps & Infrastructure · score 63

Install: claude install-skill fusedio/skills

# fused AWS infrastructure > **Part of the Fused skill set.** This covers the AWS resources only. For install > and provisioning see **`fused-setup`**; see **`fused-guide`** for the full set. fused manages a small, fixed set of AWS resources per environment. All resources are scoped to the environment's `function_prefix` (default `openfused-`). Nothing outside that scope is touched. --- ## Resources managed ### IAM role **Name**: `<prefix>` with trailing `-` stripped (e.g. `openfused-` → `fused`), or overridden with `--role-name` / `role_name` in the env config. **Why**: Every Lambda function must assume an IAM role to run. fused creates and owns this role so users don't have to wire one up manually. **What's in the inline policy** (`openfused-default`): | Statement | Permissions | Scope | |---|---|---| | `S3Access` | `GetObject`, `PutObject`, `DeleteObject`, `ListBucket` | All S3 (`arn:aws:s3:::*`) | | `LambdaSelfInvoke` | `lambda:InvokeFunction` | `arn:aws:lambda:<region>:<account>:function:<prefix>*` | | `SecretsRead` | `secretsmanager:GetSecretValue` | `arn:aws:secretsmanager:<region>:<account>:secret:<prefix>*` | | `CloudWatchLogs` | `CreateLogGroup`, `CreateLogStream`, `PutLogEvents` | All (`arn:aws:logs:*:*:*`) | | `ECRPull` *(only when `docker_image` is set)* | `ecr:GetAuthorizationToken`, `ecr:BatchGetImage`, `ecr:GetDownloadUrlForLayer` | All (`*`) | The policy is **re-applied on every `infra apply`**, so it self-heals if manually changed. **When managed*