# Account-init floors

Runtime account IDs: `.github/cp9-cleanup-accounts.json`.

## Runtime account

Owner: the 12-digit runtime account. Source DNS writes: `385595570414`.

| Name | Lookup |
|---|---|
| `cp9-developer` | `iam get-role` |
| `cp9-developer-power` | `iam get-policy --policy-arn arn:aws:iam::<acct>:policy/cp9-developer-power` |
| `cp9-developer-boundary` | `iam get-policy` |
| `cp9-starter-eks-node-boundary` | `iam get-policy` |
| `dataflow-service-infra-role` | `iam get-role` |
| `dataflow-service-infra-role-policy` | `iam get-policy` |
| `auto-deploy-cli` | `iam get-role` — present trust is the floor |
| GitHub OIDC `token.actions.githubusercontent.com` | `iam get-open-id-connect-provider`; `sts.amazonaws.com` audience is the floor |
| `cp9/dev/auth0/shared-bundle` | `get-secret-value`; keys `auth0Secret`, `proxyAuth0ClientSecret` (under `auth0` or flat) |
| `cp9/dev/auth0/account-central-management-m2m` | `get-secret-value`; keys `auth0ManagementClientID`, `auth0ManagementClientSecret` |
| `cp9/dev/auth0/o11y-m2m` | `get-secret-value`; keys `Auth0ClientID`, `Auth0ClientSecret` |
| zone `<acct>.cp9.dev.aws.tidbcloud.com` | `route53 list-hosted-zones-by-name` |
| NS `<acct>.cp9.dev.aws.tidbcloud.com` on `Z07443793I93RI8K8Z4F7` | `route53 list-resource-record-sets` |
| ACM `*.<acct>.cp9.dev.aws.tidbcloud.com` | `acm list-certificates` |
| quotas | `service-quotas get-service-quota` — live ≥ floor |

Quota floors: EIP `ec2/L-0263D0A3` 100; CIDRs/VPC `vpc/L-83CA0A9D` 10; NAT/AZ `vpc/L-FE5A380F` 20; NLB/region `elasticloadbalancing/L-69A177A2` 500; VPCs/region `vpc/L-F678F1CE` 20.

Judge each required Auth0 field: real credential vs still a placeholder (empty, dummy, template-shaped, or otherwise unusable). Write path is [`../live-floor.md`](../live-floor.md).

## 414 starter images

Owner: `385595570414`. Merge: [`ecr-merge.md`](ecr-merge.md).

Floor SIDs on us-west-2 and us-east-1 registry policy: `ExistingCrossAccountAccess`, `CP9RuntimePull` (`repository/*` pull for every cleanup account root + `cp9-developer`), `CP9DeveloperPublish`.

## 414 UI images

Owner: `385595570414`. Repo `tidbcloud/cp9-dbaas-ui`. Floor SIDs `CP9RuntimeAccountPull`, `CP9DeveloperPublish`. Merge: [`ecr-merge.md`](ecr-merge.md).

## 414 source Route53

Owner: `385595570414`. Name `cp9-source-route53-records`. `iam get-role` — present trust stays.

## GCP developer

Owner: the GCP project.

| Name | Lookup |
|---|---|
| SA `cp9-developer@<project>.iam.gserviceaccount.com` | `gcloud iam service-accounts describe` |
| WIF pool `cp9-github` / provider `controlplane9` | `gcloud iam workload-identity-pools describe` |

SA roles: `artifactregistry.reader`, `compute.admin`, `container.admin`, `dns.admin`, `iam.serviceAccountAdmin`, `iam.serviceAccountKeyAdmin`, `iam.serviceAccountUser`, `resourcemanager.projectIamAdmin`, `servicedirectory.editor`, `serviceusage.serviceUsageAdmin`, `storage.admin`. `iam.serviceAccountKeyAdmin` is for run-owned Dedicated AppBox/cluster keys; the shared `cp9-developer` SA remains keyless. Provider condition: repo `tidbcloud/controlplane9`, ref `refs/heads/main`, workflow `tidbcloud/controlplane9/.github/workflows/cp9-session-cleanup.yml@refs/heads/main`. Bind `roles/iam.workloadIdentityUser` on the SA for that pool.

BYOC/dedicated attachments on `auto-deploy-cli` (`byoc_account_setup_principal`, `dedicated_auto_deploy_cli*`) are Dedicated registration: [`../aws/init-dedicated-dataplane/SKILL.md`](../aws/init-dedicated-dataplane/SKILL.md).