Merge main into release-stage

docs/architecture/private/byoc.mdx

@@ -83,7 +83,7 @@ To get started with BYOC, customers are required to have one of the following:
 
 ### Azure
 
-#### 1. Account details
+#### 1. Provide Required Information
 
 Get the following details from your
 [Azure Portal](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) and pass them along
@@ -92,11 +92,11 @@ to the Hasura team.
 - (Required) Subscription ID
 - (Required) Tenant ID
 - (Required) Resource Group Name
-  1. Create a resource group if you do not already have one
+  - Create a resource group if you do not already have one
 - (Required) Region to deploy
 - (Required) Availability zones to deploy
-- (Optional) Preferred VPC CIDR (/16)
-  1. f you have a specific CIDR in mind for the VPC setup, please pass it along.
+- (Optional) Preferred VPC CIDR for infrastructure (/16 - /19)
+  - If you have a specific CIDR in mind for the VPC setup, please pass it along.
 
 #### 2. Create App Entities for BYOC
 
@@ -141,24 +141,65 @@ recommend setting an appropriate threshold in order to accommodate workers scali
 
 ### AWS
 
-#### 1. Account Details
-
-- AWS Account ID
-- Preferred VPC CIDR (optional, if you have a specific CIDR for the VPC setup).
-
-#### 2. Create Role
-
-- Create an IAM role for Hasura with the following permissions:
-  - EC2 Full Access
-  - S3 Full Access
-  - IAM Full Access
-
-Share the IAM role with Hasura team.
-
-#### 3. Networking
-
-- Ensure the VPC has appropriate routing and security group configurations to allow Data Plane traffic.
-- Provide CIDR ranges for ingress/egress rules to be applied during deployment.
+The setup involves creating an IAM role in the newly created AWS account; this role establishes a trust relationship with Hausra’s GCP service account which will be used to deploy and manage workloads necessary for Hasura DDN.
+
+#### 1. Create Trust Role
+
+- Log in to your AWS Management Console.
+- Navigate to IAM > Roles and click Create Role.
+- Select Custom Trust Policy as the trusted entity type.
+- Add the following trust policy to the Trust Role:
+
+```bash
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "Statement1",
+            "Effect": "Allow",
+            "Principal": {
+                "Federated": "accounts.google.com"
+            },
+            "Action": "sts:AssumeRoleWithWebIdentity",
+            "Condition": {
+                "StringEquals": {
+                    "accounts.google.com:aud": [
+                        "102619491389607674002",
+                        "[email protected]"
+                    ],
+                    "accounts.google.com:oaud": "ddn-pulumi-cli",
+                    "accounts.google.com:sub": "102619491389607674002"
+                }
+            }
+        }
+    ]
+}
+```
+
+- Attach workload-specific permissions to this role. For example:
+
+```bash
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": "*",
+            "Resource": "*"
+        }
+    ]
+}
+```
+
+- Save the Trust Role and note its ARN (e.g., `arn:aws:iam::<AWS_ACCOUNT_ID>:role/TrustRole`).
+
+#### 2. Provide Required Information
+
+Share the following ARNs with the SaaS product team:
+- (Required) Trust Role ARN: `arn:aws:iam::<AWS_ACCOUNT_ID>:role/TrustRole`
+- (Optional) Preferred VPC CIDR for infrastructure (/16 CIDR)
+  - If you have a specific CIDR in mind for the VPC setup, please pass it along.
+- (Optional) Preferred Zones
 
 ### GCP
 
@@ -171,9 +212,13 @@ Share the IAM role with Hasura team.
 
 - Give the following service account Owner access to the project: `[email protected]`
 
+#### 3. Provide Required Information
+
 - Pass along the following information to Hasura team:
-  - Project ID
-  - Preferred VPC CIDR (optional, if you have a specific CIDR in mind for the VPC setup).
+  - (Required) Project ID
+  - (Optional) Preferred VPC CIDR for infrastructure (/16 CIDR)
+    - If you have a specific CIDR in mind for the VPC setup, please pass it along.
+  - (Optional) Preferred Zones
 
 ## Upgrade Process