feat(trigger): reach AWS from trigger.dev runs through workload identity by waleedlatif1 · Pull Request #9578 · simstudioai/sim

waleedlatif1 · 2026-11-02T20:22:51Z

Why

Trigger.dev runs reach Sim's own AWS resources (S3 file storage, AppConfig, the hosted-key CloudWatch metrics, hosted Bedrock) with long-lived IAM access keys stored as Trigger.dev environment variables. Trigger.dev 4.8.3 issues short-lived workload-identity (OIDC) tokens to executing runs, which AWS STS exchanges for temporary credentials. With that, no AWS key needs to live in Trigger.dev at all.

What

lib/core/config/aws.ts: getAwsCredentials() is now the single source of credentials for Sim's own AWS clients. It picks one of three sources, in this order:

TRIGGER_AWS_ROLE_ARN is set (deployed Trigger.dev runs): temporary credentials for that role, from awsCredentialProvider in @trigger.dev/sdk/oidc/aws. This takes precedence over static keys, so a failed exchange shows up as an error instead of silently falling back to a stored key, as Trigger.dev's docs require.
Static keys: AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY, unchanged for self-hosted deployments.
Neither: undefined, so the default chain applies (the ECS task role).

Wiring

The S3, AppConfig, hosted-key CloudWatch and hosted-Bedrock clients pass this explicitly. CloudWatch and the Bedrock path used to rely on the default chain finding env keys.
A user's own Bedrock keys still take precedence, and no user integration ever receives these credentials.

Credential lifetime. Sim's AWS clients live for the whole process, while a token can only be minted while an attempt is executing. So:

One session per worker process. It is fixed-name, sim-trigger-worker, rather than run-named, so later runs' calls aren't attributed to the run that minted it.
Refreshed in trigger.config.ts init at the start of each attempt, whenever less than 30 minutes remain. Work a run leaves behind, such as the 5-second metrics flush, still has valid credentials after the attempt ends.
Refreshed 10 minutes before expiry otherwise. That's longer than the AWS SDK's own 5-minute window, so a client never spins on credentials this module still considers fresh. Concurrent callers share one exchange.

Hosted-key metrics now turn on based on isHosted rather than on whether AWS_ACCESS_KEY_ID is present. Hosted keys only exist on Sim Cloud, and removing static keys must not turn the metrics off.

Trigger.dev 4.8.3

SDK, core, build and both workflows' CLI pins move from 4.8.2 to 4.8.3. Release notes: workload identity, plus one chat resume-cursor fix.
4.8.3 was published 2026-10-30. It sits in minimumReleaseAgeExcludes until it clears the 7-day window on 2026-11-06; the comment says to drop it then.

Rollout

Nothing changes until TRIGGER_AWS_ROLE_ARN is set in a Trigger.dev environment. Without it, runs keep today's static keys.

For each environment:

Set the variable.
Confirm the role is being assumed and the static key's last-used time stops moving.
Remove the static keys from that Trigger.dev environment.

ECS is unaffected: it never sets the variable.

Verification

Type-check passes across all 29 workspaces. The real proof is end to end, on staging after merge:

STS AssumeRoleWithWebIdentity events from staging runs appear in CloudTrail.
S3, AppConfig and metrics calls succeed under the role session.
The static key's last-used time stops advancing.

Trigger.dev runs reached S3, AppConfig, CloudWatch and hosted Bedrock with the app IAM user's static keys. With TRIGGER_AWS_ROLE_ARN set, Sim's own AWS clients now use temporary credentials for that role, exchanged for the run's Trigger.dev workload-identity token (SDK 4.8.3). One session serves the worker process, refreshed at each attempt's start so the post-run metrics flush keeps valid credentials. Static keys and the default chain are unchanged for ECS and self-hosted deployments.

4.8.3 is the first release with workload identity. The exclusion is temporary and comes out once it clears the 7-day threshold on 2026-11-06. Hosted-key metrics now key off Sim Cloud itself instead of the presence of static AWS keys, so removing those keys never silences them.

vercel · 2026-11-02T20:22:56Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Nov 2, 2026 9:23pm UTC

greptile-apps · 2026-11-02T20:25:46Z

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable issues remain in the reviewed changes.

Summary

Adds workload identity for Sim-owned AWS clients in Trigger.dev runs.

Trigger.dev runs can use temporary AWS role credentials for Sim’s services.
Hosted-key metrics follow the hosted deployment setting.

Both earlier review threads are addressed: the default lookup preserves session tokens, and SES now receives workload credentials. No new actionable issues were found.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Sim-owned AWS client] --> B{Workload role configured?}
  B -->|No| C[AWS default credential lookup]
  B -->|Yes| D{Cached credentials fresh enough?}
  D -->|Yes| E[Use cached credentials]
  D -->|No| F[Exchange workload token]
  F -->|Success| G[Save temporary credentials]
  F -->|Failure| H{More than 60 seconds remain?}
  H -->|Yes| E
  H -->|No| I[Return error]

_{Reviews (3) · Last reviewed commit: "fix(aws): serve unexpired workload crede..." · Reviewed by Greptile}

cubic-dev-ai

All reported issues were addressed across 13 files

_{Turn on auto-fix | Re-trigger cubic}

The init hook loads app modules by relative path, which the source-convention ratchet caps. Warming Redis and refreshing workload-identity credentials now sit behind prepareTriggerAttempt, so init still imports one module.

getAwsCredentials returned explicit static keys when present, which dropped AWS_SESSION_TOKEN for clients that used to reach it through the default chain (Bedrock, CloudWatch). It now returns the workload-identity provider or undefined, so every non-Trigger path resolves exactly as before. The SES email client reads it too, so worker email keeps working once static keys leave Trigger.dev. The release-age comment records why the exclusions are bare names.

…ads them The S3 client resolves credentials through the SDK default chain, which reads process.env, so the presigner test stubs the keys there instead of the env module mock.

waleedlatif1 · 2026-11-02T21:15:48Z

@greptile

waleedlatif1 · 2026-11-02T21:15:49Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-02T21:15:56Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 16 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

Outside an executing attempt no workload-identity token can be minted, so a post-run metrics flush near the refresh window failed even though the cached credentials were still valid. A failed exchange now keeps serving the cached credentials until a minute before they expire.

waleedlatif1 · 2026-11-02T21:23:33Z

@greptile

waleedlatif1 · 2026-11-02T21:23:34Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-02T21:23:40Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 16 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

waleedlatif1 added 2 commits November 2, 2026 12:15

waleedlatif1 requested a review from a team as a code owner November 2, 2026 20:22

greptile-apps Bot reviewed Nov 2, 2026

View reviewed changes

Comment thread apps/sim/providers/bedrock/index.ts Resolved

Comment thread apps/sim/lib/core/config/aws.ts Resolved

cubic-dev-ai Bot reviewed Nov 2, 2026

View reviewed changes

Comment thread bunfig.toml Resolved

Comment thread apps/sim/lib/core/config/aws.ts Resolved

Comment thread apps/sim/lib/core/config/aws.ts Resolved

vercel Bot deployed to Preview November 2, 2026 20:29

View deployment

refactor(trigger): run the per-attempt setup through one module

e93a105

The init hook loads app modules by relative path, which the source-convention ratchet caps. Warming Redis and refreshing workload-identity credentials now sit behind prepareTriggerAttempt, so init still imports one module.

vercel Bot temporarily deployed to Preview November 2, 2026 20:38 Inactive

waleedlatif1 added 2 commits November 2, 2026 12:42

test(uploads): give the presigner credentials where the client now re…

e47cd97

…ads them The S3 client resolves credentials through the SDK default chain, which reads process.env, so the presigner test stubs the keys there instead of the env module mock.

vercel Bot temporarily deployed to Preview November 2, 2026 21:01 Inactive

cubic-dev-ai Bot reviewed Nov 2, 2026

View reviewed changes

Comment thread apps/sim/lib/core/config/aws.ts Resolved

vercel Bot temporarily deployed to Preview November 2, 2026 21:23 Inactive

cubic-dev-ai Bot reviewed Nov 2, 2026

View reviewed changes

waleedlatif1 merged commit 478d9ec into staging Nov 2, 2026
89 checks passed

waleedlatif1 mentioned this pull request Nov 2, 2026

v0.9.41: browser extension, ci improvements #9579

Merged

waleedlatif1 deleted the feat/trigger-workload-identity branch November 2, 2026 23:25

Conversation

waleedlatif1 commented Nov 2, 2026

Why

What

Rollout

Verification

Uh oh!

vercel Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Nov 2, 2026

Uh oh!

waleedlatif1 commented Nov 2, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 2, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Nov 2, 2026

Uh oh!

waleedlatif1 commented Nov 2, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 2, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Nov 2, 2026 •

edited

Loading

greptile-apps Bot commented Nov 2, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading