feat(emitters): render the sandbox into the generated packages

[ItamarZand88]

Summary

Renders the sandbox into the three packages a deployment installs from: the Terraform module, the CloudFormation template, and the Helm chart. Layer 3 declared what a sandbox may do; this builds the infrastructure it does it with.

On AWS, installing a sandbox creates the image its sessions launch from and the network path they are allowed:

1. Two roles are created — one the image build runs as, one Lambda assumes to place the connector's network interfaces.
2. A barrier holds the next two resources back until both roles carry their policies and IAM has caught up.
3. A security group that permits nothing outbound, and a connector pinned to it and to the deployment's own private subnets.
4. The image is built through AWS's own internet connector, because a build has to reach a registry — while a session runs through the deny connector instead, which is what actually bounds it. That split is the heart of this change.

On Kubernetes the same boundary is a NetworkPolicy; on GCP a sandbox is a subprocess of the workload's own instance and creates nothing.

What I did

Three things are worth pointing at, each of which was a deployment failure before it was a decision:

• The image goes through Cloud Control, not the awscc provider. The schema makes AdditionalOsCapabilities required and a sandbox asks for none of them; awscc drops an empty list before sending, so creation returned Model validation failed (#: required key [AdditionalOsCapabilities] not found) and no image was ever built. Cloud Control sends the body as written, so the property names here are the schema's own. The connector still goes through awscc, which is what the provider requirement keys off.
• The image names AWS's INTERNET_EGRESS connector. Naming the deny connector there leaves the build with nowhere to reach a registry and the image never becomes active. A session's egress is the connector passed when it starts, which is still the deny one.
• A barrier sits between the roles and what uses them. Both roles are referenced by ARN, which Terraform resolves as soon as the role exists — before its policy is attached and before IAM has propagated it. Without the barrier the first apply failed to assume the operator role and a retry succeeded, which is the worst shape for a customer's first install. It keys on the roles' unique ids, because the name is templated and a replaced role keeps its ARN.

Files touched

• crates/alien-terraform/src/emitters/aws/sandbox.rs and generator.rs — the module.
• crates/alien-cloudformation/src/emitters/aws/sandbox.rs — the template.
• crates/alien-helm/src/emitters/sandbox.rs — the NetworkPolicy and the broker's cluster-scoped RBAC.

How I tested

• cargo test -p alien-terraform -p alien-cloudformation -p alien-helm — 315 tests, including terraform validate on the rendered module and helm lint / helm template / kubeconform on the chart.
• Mutation-tested each guard that matters, by breaking it and watching the test fail: pointing the image back at the deny connector, removing the connector's wait on the barrier, and putting an unscoped ARN back. Each assertion is scoped to the resource block it is about, so a reference appearing elsewhere in the module cannot satisfy it.
• Checked every action in the emitted policies against the pinned AWS IAM dataset, which is what a scoped role enforces and what a deployment test with broad credentials cannot show.

Security review of this diff, since it renders the IAM and the network path a customer installs:

• A session reaching the internet — refused by the connector, and the module is refused outright rather than rendered if the declaration asks for an egress mode AWS cannot enforce.
• The operator role reaching beyond its job — it creates network interfaces only, now against the deployment's own region and account rather than every subnet and security group in the account.
• A setup-time or management-time identity reaching session contents — none of the three actions that can are emitted here, and content-bearing logging is off on the image.
• A chart that cannot bound a pod — the Helm emitter refuses a resource it cannot read rather than emitting a chart with no NetworkPolicy.
• Session output reaching the control plane — logging is disabled on the image itself.

Nothing turned up.

[greptile-apps]

Greptile Summary

The PR adds sandbox infrastructure generation across AWS CloudFormation, AWS Terraform, and Kubernetes Helm.

• Creates AWS MicroVM images, IAM roles, deny-egress connectors, and registration payloads.
• Adds Kubernetes NetworkPolicy and broker TokenReview RBAC resources.
• Registers the new emitters and extends generator validation coverage.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains within the eligible follow-up review scope.

No blocking failure remains.

Important Files Changed

Filename	Overview
crates/alien-terraform/src/emitters/aws/sandbox.rs	Adds AWS sandbox MicroVM, IAM, propagation barrier, deny-egress connector, and import/binding output generation.
crates/alien-cloudformation/src/emitters/aws/sandbox.rs	Adds the CloudFormation equivalent of the AWS sandbox resources and exported registration data.
crates/alien-helm/src/emitters/sandbox.rs	Adds sandbox NetworkPolicy generation and cluster-scoped TokenReview RBAC for Kubernetes.
crates/alien-terraform/src/generator.rs	Excludes Kubernetes sandboxes from cloud-specific Terraform emission and adds required provider handling.
crates/alien-cloudformation/src/built_ins.rs	Registers the AWS sandbox emitter in the built-in CloudFormation registry.
crates/alien-helm/src/emitters/mod.rs	Registers the Kubernetes sandbox emitter in the Helm registry.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Stack["Sandbox declaration"] --> Target{"Package target"}
  Target -->|Terraform| TF["AWS Terraform module"]
  Target -->|CloudFormation| CFN["AWS CloudFormation template"]
  Target -->|Helm| Helm["Kubernetes Helm chart"]
  TF --> AWS["MicroVM image, IAM roles, deny connector"]
  CFN --> AWS
  Helm --> K8s["NetworkPolicy and broker RBAC"]
  AWS --> Import["Sandbox registration and binding data"]
  K8s --> Import

Loading

_{Reviews (29): Last reviewed commit: "feat(emitters): render the sandbox into ..." | Re-trigger Greptile}