docs(buckets): add AWS S3 and GCS bucket setup guides#128
Closed
miru-agents wants to merge 3 commits into
Closed
Conversation
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SQNjMgcXZYrXA62jydSntw
Add AWS, S3, GCS, GCP, IAM (acronyms) and Amazon, Google, Cloud, Storage (proper nouns) to the heading-case allowlist so the Amazon S3 and Google Cloud Storage bucket guides can use sentence-case titles and headings. Add matching TestCheck_Allowlist and TestCheck_FrontmatterTitle cases, and seed cspell with the bucket guides' spell-check tokens. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SQNjMgcXZYrXA62jydSntw
Add customer-facing setup guides under Learn > Buckets: the AWS S3 guide (exact sts:ExternalId trust policy, expected CloudTrail AccessDenied from Miru's enforcement probe, .miru/probe/ lifecycle rule) and the GCS guide (WIF pool/provider pinned to the workspace-id session name, service-account impersonation binding). Register both in docs.json nav. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SQNjMgcXZYrXA62jydSntw
miru-agents
marked this pull request as ready for review
July 14, 2026 15:47
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds two customer-facing bucket setup guides (there were none) under a new Learn → Buckets nav group, documenting how to configure cloud storage so Miru can verify and use it — with the emphasis on the per-tenant binding the GCS tenant-binding work introduced.
learn/buckets/aws.mdx(Amazon S3) — create the bucket + cross-account IAM role; a trust policy requiring an exactStringEqualssts:ExternalIdon the workspace id (with a<Warning>that wildcard/absent conditions fail verification, since Miru probes external-id enforcement);s3:PutObjectfor uploads + the.miru/probe/verification probe (optional scopeds3:DeleteObject); a<Note>that benign CloudTrailAccessDeniedevents from Miru's negative probe are expected; and a recommended.miru/probe/lifecycle rule.learn/buckets/gcs.mdx(Google Cloud Storage) — create the bucket + service account; set up Workload Identity Federation with anattribute_conditionthat pins the full assumed-role ARN including the workspace-id session name (<Warning>that a role-only prefix fails verification); grant impersonation via aprincipal://…/subject/…binding to that exact session (gcloud + Terraform in a<CodeGroup>); recommended lifecycle rule.Both consistent with the merged
external_id/session_namefield descriptions (openapi #197) and the infra WIF fixture (#178). Miru's AWS account id is a<miru-aws-account>placeholder (copy from the dashboard/support) rather than hardcoded.Changes
docs/learn/buckets/aws.mdx,docs/learn/buckets/gcs.mdx— new guides.docs/docs.json— new "Buckets" sub-group under Learn.c35374a) heading-case allowlist + tests + cspell tokens for the cloud acronyms/product names.Validation
Ran the repo's lint gate locally against both files: the Go MDX/heading-case prose linter,
cspell, andeslint --max-warnings=0all report 0 issues, andgo test ./tools/lint/...passes. Full CI (ci.yml) re-runs these plusmint openapi-check.🤖 Generated with Claude Code
https://claude.ai/code/session_01SQNjMgcXZYrXA62jydSntw
Generated by Claude Code
Need help on this PR? Tag
/codesmithwith what you need. Autofix is disabled.