emfirge_setup_help
Return a ready-to-click CloudFormation deploy URL and instructions for creating the read-only IAM role.
Parameters
No parameters.
Help me set up Emfirge
Returns
The response is JSON shaped for the operation. The fields and semantics are described below.
Deploy URL: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=…&stackName=EmfirgeReadOnlyStack¶m_ExternalId=aws-risk-agent
1. Open the URL.
2. Tick the IAM acknowledgement and Create stack (~30s).
3. On CREATE_COMPLETE, copy RoleArn from Outputs.
4. Paste the RoleArn back here and run a scan.
Validation, behavior, and limits
The response contains a CloudFormation quick-create URL pre-filled with ExternalId aws-risk-agent and step-by-step instructions; the assumed role session is 3600 seconds (1 hour): open it, acknowledge IAM resources, create the stack (about 30 seconds), then copy RoleArn from Outputs and provide it with a region to emfirge_scan.
The RoleArn starts with arn:aws:iam::. The default trusted account is 000000000000 and ExternalId is aws-risk-agent (override with EMFIRGE_EXTERNAL_ID); self-hosting can override them with EMFIRGE_TRUSTED_ACCOUNT_ID and EMFIRGE_EXTERNAL_ID.
Terminal clients including Claude Code, Codex CLI, and Kiro CLI hide tool output by default. If only ‘click the link above’ appears, ask the assistant to print the deploy URL verbatim. A 403 is a reason to call setup_help again.