AWS Access
If your account already has access
Create and update are different operations, and GovIntel resolves none of it on your behalf because it cannot see inside your account.
The role name is fixed per account, and the stack name is fixed too. If either already exists, creating them again fails.
Why the name is not simply made unique
Fixing the role name per account is what lets GovIntel derive the role identifier from twelve digits, which is the whole of the onboarding experience. Suffixing it per engagement would trade one problem for a permanent proliferation of near-identical roles in your account.
So the product knows how to update, not only how to create.
The states an account can be in
| State | What it means | What happens |
|---|---|---|
| Fresh | Nothing of GovIntel's is present | Create everything |
| Ready | Everything present, current, and inside its window | Verify only |
| Reassessment | Ours, but the engagement has moved on | Update: same stack, same role, new expiry |
| Partial | Some present, some missing | Create only the gap |
| Stack rolled back | A dead stack from a failed create | Recoverable only if it holds nothing |
| Foreign role | A role with our name that cannot be proved to be ours | Stop. Nothing is touched |
| Provider incompatible | Your identity provider cannot carry our tokens | Stop. Nothing is touched |
| Role permissions invalid | Ours by tag and trust, but carrying grants the template never attached | Stop. Nothing is touched |
| Ownership unknown | Who manages the role could not be established | Stop. Unknown is not owned |
The four that stop
The last four are deliberate. GovIntel has no read access to your account and therefore cannot verify what it would be changing. Modifying a role it cannot prove is its own would be acting on a guess inside somebody else's production environment.
In each case you are told what was found and what to check. Nothing is altered until it is resolved.