# Use a Two-Hop BYOC Runtime Role Chain

BYOC DPM/Crossplane uses a two-hop runtime identity chain:

1. the remote EC2 instance profile assumes the session-scoped
   `<session>-byoc-dataplane-manager` role in the control-plane account;
2. that role assumes the fixed
   `tidbcloud-dataplane-manager-assumed-role` created by production account
   setup in the customer account.

The CP-side BYOC DPM role is distinct from the Premium DPM role. The customer
role retains the production trust contract for control-plane principals whose
role name matches `*-dataplane-manager`; CP9 does not grant the remote instance
profile a direct customer-account trust path. DPM/Crossplane obtains both hops
through workload provider configuration backed by the instance profile. The
local account-setup profile and static AWS credentials are never installed on
the remote host or in Kubernetes.

Activation proves the first and second assumed-role identities and records the
role ARNs without credentials. Revalidation reads the live customer role and
requires its exact production trust contract in addition to the sanitized
runtime evidence. It also fails closed unless a direct assume from the remote
instance profile to the customer role is denied. This preserves the production
cross-account authorization boundary while isolating BYOC from the folded
Premium regional control plane.