Documentation / Security & Access
AWS IAM roles, secrets, tool scopes and runtime isolation
Isolate handler execution roles, bind tenant secrets, scope MCP tools, block SSRF and neutralize prompt injection.
1. Handler AWS IAM roles and runtime isolation
Handlers never receive Controller, DynamoDB coordination table, or signing credentials. Choose an approved isolation mode per phase; STS session guardrails explicitly deny iam:*, role chaining, and reserved Rippflow resources.
| Isolation Boundary | Credential & Process Model | Availability & Caveats |
|---|---|---|
dedicated_lambda_execution_role | Separate AWS Lambda function running under its own executionRoleArn invoked via a version-scoped invocationRoleArn. | Implemented on main; required for strict principal/hardware isolation. |
hardened_subprocess_with_scoped_session | Runner assumes an installation-approved role alias (e.g., orders-reader) and injects short-lived STS credentials into a fresh subprocess. | Requires scoped-IAM patch (core PR #27, runner PR #8); local rippflow dev does not assume IAM roles. |
Managed subprocess temporary workspaces (workspace.rs) | Per-invocation scratch workspace lifecycle documented in earlier design specs. | Known gap: absent from pinned main. Treat local/container handlers as trusted programs. |
2. Tool scopes, MCP approvals and secret redaction
Governed tools (>=1.7.0) verify four separate identities: caller principal, workflow allowlist, per-tool authorization.scopes (preventing cross-tool privilege escalation on the same MCP server), and tenant-scoped secret://<tenant_id>/... references. Never store plaintext secrets in workflow definitions.
shell
rippflow tools list --json
rippflow mcp servers --json
rippflow operations list --status pending_approval --json
rippflow operations approve OPERATION_ID --reason "verified CRM ticket" --json3. Outbound SSRF and prompt-injection boundaries
- Outbound network & SSRF protection: Rejects cleartext
http://, blocks cloud metadata (169.254.169.254,169.254.170.2,fd00:ec2::254,metadata.google.internal) and private/loopback IP ranges, disables3xxredirects, and bounds payloads (256 KiB request / 1 MiB response). - Credential blocking & redaction: Blocks forwarding
AWS_SECRET_ACCESS_KEY,AWS_SESSION_TOKEN,RIPPFLOW_CONTROL_PLANE_*, and redacts sensitive fields to[REDACTED]before persisting history or logs. - Prompt-injection envelope: Wraps tool outputs as untrusted data and strips reserved override keys (
_rippflow_policy_override,bypass_approval,budget_ceiling_override,ownership_epoch_override).
Verified sources
Checked 2026-11-05.
- Dedicated Lambda and scoped subprocess IAM 04cb082 · main
- Scoped handler IAM setup and STS guardrails 3a3be99 · main
- Governed tool scopes, SSRF and prompt injection 3a3be99 · main
- Tools, MCP and approval operations 7f5ea32 · main