MIDDAG access to your AWS account (CloudFormation)

MIDDAG accesses your AWS account with no IAM user and no access key. A CloudFormation stack creates IAM roles that trust only MIDDAG accounts and that expire on their own on the agreed date.

What the stack creates

It creates only IAM roles and, if requested, EKS access entries. It creates no network, no instance and nothing that costs money.

Role	Can	Cannot
middag-audit	Read the account configuration (ReadOnlyAccess)	Read secrets, credentials and data content (buckets, databases, queues)
middag-operate	Operate services (PowerUserAccess)	IAM, billing and Organizations
middag-admin	Administer the account. MIDDAG's access to it is temporary and approved case by case	—
middag-probe	Nothing; it only proves that the stack exists and is valid	Any read

Trust is valid until the ExpiresOn parameter (inclusive). After that date AWS denies access even if the role still exists.

Template versions

Version	Date	URL	SHA-256
1.0.0	2026-11-03	https://mdg-access-shared-s3-cfn-templates.s3.us-east-1.amazonaws.com/client-access/v1.0.0/client-access.yaml	3e4f94a32316abc6ab58675ae416e26b82e978df4e9d3718da1ba629281cf4a5

There are two ways to check the file. The first is to download it and compare the result with the SHA-256 column of the table:

curl -fsSO https://mdg-access-shared-s3-cfn-templates.s3.us-east-1.amazonaws.com/client-access/v1.0.0/client-access.yaml
sha256sum client-access.yaml

The second is to read the checksum that S3 stored at upload, without downloading the file. S3 returns the SHA-256 in base64; for version 1.0.0 the expected value is Pk+UoyMWq8arWGda5Bbia4LpeN9OnTcY2humKSgc9KU=:

aws s3api head-object --no-sign-request --region us-east-1 --checksum-mode ENABLED \
  --bucket mdg-access-shared-s3-cfn-templates --key client-access/v1.0.0/client-access.yaml \
  --query ChecksumSHA256 --output text

Without the AWS CLI, the same value comes in the x-amz-checksum-sha256 header (only with the request header x-amz-checksum-mode: ENABLED):

curl -sI -H 'x-amz-checksum-mode: ENABLED' https://mdg-access-shared-s3-cfn-templates.s3.us-east-1.amazonaws.com/client-access/v1.0.0/client-access.yaml | grep -i x-amz-checksum-sha256

Create the stack from the link you received

MIDDAG sends the link through a private channel, with the parameters filled in.

1. Open the link while signed in to your account, in us-east-1.
2. Review the parameters. To see what will be created first, use "Create change set".
3. Tick the IAM resources and auto-expand acknowledgements and click Create stack.
4. Tell MIDDAG that the stack was created. No ARN and no credential are needed.

Alternatives

• Console without the link: "Create stack" → "Upload a template file", using the file downloaded from the version URL. Fill in the parameters MIDDAG gave you.

• CLI:

  aws cloudformation create-stack --region us-east-1 --stack-name middag-client-access \
    --template-url https://mdg-access-shared-s3-cfn-templates.s3.us-east-1.amazonaws.com/client-access/v1.0.0/client-access.yaml \
    --capabilities CAPABILITY_NAMED_IAM CAPABILITY_AUTO_EXPAND \
    --parameters ParameterKey=Alias,ParameterValue=<alias> ParameterKey=ExpiresOn,ParameterValue=<YYYY-MM-DD> ...

  Without access to the URL, use --template-body file://client-access.yaml.

Update

Go to Update → Replace current template → S3 URL of the new version. Never use "Use existing template": the stack keeps the already-processed template, with the old values.

Revoke

Delete the stack (aws cloudformation delete-stack --stack-name middag-client-access). To cut an open session right away, use "Revoke active sessions" on the role in the IAM console.

Last resort: create the roles by hand

If your policy does not allow CloudFormation, ask MIDDAG for each role's trust and policies and create them in the IAM console. The Deny of the middag-operate role must not be left out.