AWS trusted backend operations

Complete SDK coverage includes control-plane operations so studios can build deployment tools, dedicated-server workflows, and custom trusted services. It does not make those operations safe for an untrusted game client.

Every generated operation is explicitly classified as Player, Player or Trusted Backend, or Trusted Backend. The classification tables live under Scripts/awsik-sdk/services/; coverage validation fails when an SDK update adds an operation without a reviewed classification. Blueprint categories and generated descriptors carry the same classification.

Do not grant a player identity permission to create or alter pools, users, buckets, tables, functions, policies, fleets, builds, queues, log destinations, alarms, or GraphQL infrastructure. Run those nodes only in an editor tool, dedicated server with a scoped workload role, CI deployment job, or your own authenticated backend. Shipping binaries may contain the nodes; IAM remains the authority.

Use portable roles for player-facing gameplay. They expose narrow operations, validate arguments, share refreshable credentials, normalize errors, and keep provider names out of gameplay code. Review IAM policies and CloudTrail activity whenever a role's capability changes.