AWS Account and Profile Map
The single reference for HungryHub’s AWS accounts, their SSO profiles, the
Kubernetes cluster contexts, and the home-vs-genai OIDC split. This information
was previously scattered across the workspace AGENTS.md, the Relay bot doc, and
the Terraform doc — consolidate here and link back.
Always verify the active profile/context before running any command.
aws sts get-caller-identity --profile <name>for AWS,kubectl config current-contextfor Kubernetes.
The four AWS accounts
| Profile | Account ID | Purpose | Default region |
|---|---|---|---|
sandbox | 079994049689 | Main infrastructure — dev/sandbox (home) | ap-southeast-1 |
prod | 202255947274 | Main infrastructure — production (home) | ap-southeast-1 |
genai-sandbox | 965444437277 | HungryHub AI — dev (genai) | us-east-1 |
genai-prod | 512438352490 | HungryHub AI — production (genai) | us-east-1 |
SSO start URL: https://hungryhub-sso.awsapps.com/start. The permission set
(SSO role) each profile assumes depends on the teammate’s access — run
aws sts get-caller-identity --profile <name> to see the role you actually
have in a given account.
aws configure list-profiles # list configured SSO profiles
aws sts get-caller-identity --profile <name> # confirm account + role
aws sso login --profile <name> # refresh an expired session
Kubernetes cluster contexts
| Context name | Provider | Account / Org | Environment |
|---|---|---|---|
arn:aws:eks:ap-southeast-1:079994049689:cluster/eks-dev-262 | AWS EKS | sandbox (079994049689) | Dev (default) |
arn:aws:eks:ap-southeast-1:202255947274:cluster/eks-prod-21 | AWS EKS | prod (202255947274) | Production |
do-sgp1-production | DigitalOcean | sgp1 | Production |
do-sgp1-staging | DigitalOcean | sgp1 | Staging |
kubectl config get-contexts # list contexts
kubectl config current-context # show active
kubectl config use-context <name> # switch
The default context is the EKS dev cluster. Always set the context explicitly before running commands; never assume.
The home-vs-genai split
The four accounts pair into two groups, and which repo manages which is the single most-confused thing about this layout:
| Group | Accounts | Region | Primary repos |
|---|---|---|---|
| Home | sandbox / prod | ap-southeast-1 | hungryhub-terraform, hungry-hub-iam |
| Genai | genai-sandbox / genai-prod | us-east-1 | hungryhub-ai, hh-relay |
The one exception: the relay-ci stack in hungry-hub-iam manages the
relay-eval-ci OIDC role in the genai accounts, even though the rest of
that repo is home-account. This is deliberate — see
Relay CI Stack Pattern.
Secret wiring per stack
hungry-hub-iam/.github/workflows/terraform-stacks.yml selects the OIDC role and
state backend per stack:
| Stack group | Secrets read | Points at |
|---|---|---|
Home stacks (github-oidc, oidc-permissions, secrets-manager-layout, secrets-manager-access, engineer-access) | OIDC_ROLE_ARN_{PROD,DEV}, S3_BUCKET_{PROD,DEV}, DYNAMO_TABLE_{PROD,DEV}, AWS_ACCOUNT_ID_{PROD,DEV}, OIDC_PROVIDER_ARN_{PROD,DEV} | prod 202255947274 / sandbox 079994049689 |
relay-ci (genai exception) | the _RELAY_CI_* variants of all of the above | genai-prod 512438352490 / genai-sandbox 965444437277 |
Related
- Relay CI Stack Pattern — the genai exception in detail
- OIDC Subject Pinning Patterns
- hungryhub-iam — Architecture and Operations
- hungryhub-terraform — Architecture and Operations
hungry-hub-iam/docs/cross-account-oidc.md(Tier 3 — full secret-name → env-var table)