saaslayer

SaaSLayer onboarding CLI. Bootstrap an AWS account for the SaaSLayer control plane and register a service's RBAC manifest.

Install

npm install -g saaslayer

Or run without installing:

npx saaslayer --help

Requires Node.js >= 18. The init command shells out to the AWS CLI, which must be installed and authenticated.

Commands

saaslayer init

Deploy the host-account bootstrap (3 IAM roles + permissions boundary + artifact bucket) into the caller's AWS account, trusting the SaaSLayer control plane. Uses the bundled templates/host-account.yml.

saaslayer init \
  --control-plane-account <12-digit-account-id> \
  --external-id <secret> \
  [--stack-name saaslayer-host-account] \
  [--region us-east-1] \
  [--stack-name-prefix sl-] \
  [--template PATH] \
  [--dry-run]

| Flag | Env | Description | | --- | --- | --- | | --control-plane-account | SAASLAYER_CONTROL_PLANE_ACCOUNT | 12-digit AWS account id allowed to assume the deploy role. Required. | | --external-id | SAASLAYER_EXTERNAL_ID | Trust secret shared during onboarding. Required. | | --stack-name | — | CloudFormation stack name. Defaults to saaslayer-host-account. | | --region | AWS_REGION | Deploy region. Defaults to us-east-1. | | --stack-name-prefix | — | Prefix for provisioned resources. Defaults to sl-. | | --template | — | Override the bundled template path. | | --dry-run | — | Validate the template only; deploy nothing. |

saaslayer rbac register <manifest.json>

Upsert a service's rbac.manifest.json into the RBAC catalog (POST /catalog/register). Run by a human or wired into CI.

saaslayer rbac register ./rbac.manifest.json \
  --api-base https://api.example.com \
  [--token $SAASLAYER_TOKEN]

| Flag | Env | Description | | --- | --- | --- | | --api-base | SAASLAYER_API_BASE | RBAC catalog API base URL. Required. | | --token | SAASLAYER_TOKEN | API key. Required. |

License

Proprietary. All rights reserved. See LICENSE.