Dynamic engines
Console pages for addresses that store nothing and mint a short-lived credential on demand: engines, leases and bulk revocation.
Path: Integrations > Dynamic Engines (/integrations/dynamic). Lists your addresses that store no value: when a job asks, we mint an expiring upstream credential. Concept: dynamic values.
Engine list
Above the list: how many engines you have, how many are on, and how many credentials we minted that have not expired yet.
| Column | Content |
|---|---|
| Address | The address, linked to it under Projects, with its project and environment |
| Engine | What it mints |
| Connection | The integration we mint through |
| Live | Leases that have not expired |
| Lifetime (default / max) | Lifetime bounds |
| State | On or Off |
The row menu (dynamic:configure) opens the address, turns the engine off or on, or removes it. Turning one off stops new credentials; credentials we already issued keep working until they expire.
You mint and revoke on the address, not on this list.
Engines
| Engine | Mints | Accepted connections |
|---|---|---|
| AWS STS assumed role (AssumeRole) | Access key, secret and session token for a named role | AWS IAM, or AWS role (chains: the connection's own assumed session is the caller) |
AWS session credentials expire on their own and cannot be revoked one at a time. Revoking sessions for a role affects every live lease on that role.
Add a minting address
Path: the environment's key list under Projects. The dialog asks you for the engine, the connection, the address, and the engine's configuration. The engine, not the form, decides eligible connections and lifetime bounds.
Address page
| Element | Behavior |
|---|---|
| Mint panel | Replaces the current value. No stored value, no version history, no Set New Version |
| Leases | Live leases with who took each and its expiry |
| Revoke | One button for every live session on the role; the AWS engine has no per-lease revoke |
Revoke all sessions
Open the dialog (dynamic:read). We compose the deny policy, name the role it belongs on, and count affected sessions. We write and apply nothing.
Attach the policy to the role in your AWS account (revoking IAM role sessions). We do not apply it: we grant no connection permission to edit IAM roles.
Confirm (dynamic:revoke). We record that you applied the policy and mark revoked only the sessions issued before the timestamp the dialog showed.
The confirm step keeps the lease list from claiming a revocation nobody performed.
Lease route
A switch on the environment's Settings tab lets your machines mint over the API instead of through the console. You see it once the environment holds a minting address.
Required permissions
Permission slugs: roles and permissions. Step-up rules: Security and two-factor.
| Action | Needs | Step-up | Recorded as |
|---|---|---|---|
| Open the engine list | dynamic:read | No | not recorded |
| Add a minting address | dynamic:configure | Yes | integration.engine_created |
| Turn one on or off | dynamic:configure | Yes | integration.engine_toggled |
| Remove one | dynamic:configure | Yes | integration.engine_removed |
| Mint a credential | dynamic:generate | Yes | integration.lease_issued |
| Open the bulk revoke dialog | dynamic:read | No | not recorded |
| Confirm the policy was applied | dynamic:revoke | Yes | integration.leases_revoked |
| Turn the lease route on | dynamic:configure | Two-factor and fresh | integration.lease_api_changed |
| Turn the lease route off | dynamic:configure | No | integration.lease_api_changed |
Both machine roles carry dynamic:generate, because minting reads a credential rather than changing a stored one. A custom machine role can withhold it.
Next: browsing the record.